mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 13:11:28 +00:00
d7234e2582
The new version improves the detection mechanism to cover PHP environments with .htaccess files and adds spidering to locate password protected resources automatically.
80 lines
3.0 KiB
Lua
80 lines
3.0 KiB
Lua
description = [[
|
|
Tests whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738).
|
|
|
|
It works by checking if the target paths require authentication or redirect to a login page that could be
|
|
bypassed via a HEAD request. RFC 2616 specifies that the HEAD request should be treated exactly like GET but
|
|
with no returned response body. The script also detects if the URL does not require authentication at all.
|
|
|
|
For more information, see:
|
|
* CVE-2010-0738 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0738
|
|
* http://www.imperva.com/resources/glossary/http_verb_tampering.html
|
|
* https://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_%28OWASP-CM-008%29
|
|
|
|
]]
|
|
|
|
---
|
|
-- @usage
|
|
-- nmap --script=http-vuln-cve2010-0738 --script-args 'http-vuln-cve2010-0738.paths={/path1/,/path2/}' <target>
|
|
--
|
|
-- @output
|
|
-- PORT STATE SERVICE
|
|
-- 80/tcp open http
|
|
-- | http-vuln-cve2010-0738:
|
|
-- |_ /jmx-console/: Authentication bypass.
|
|
--
|
|
-- @args http-vuln-cve2010-0738.paths Array of paths to check. Defaults
|
|
-- to <code>{"/jmx-console/"}</code>.
|
|
|
|
author = "Hani Benhabiles"
|
|
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
|
categories = {"safe", "auth", "vuln"}
|
|
|
|
local http = require "http"
|
|
local shortport = require "shortport"
|
|
local stdnse = require "stdnse"
|
|
local table = require "table"
|
|
|
|
portrule = shortport.http
|
|
|
|
action = function(host, port)
|
|
local paths = stdnse.get_script_args(SCRIPT_NAME..".paths")
|
|
local result = {}
|
|
|
|
-- convert single string entry to table
|
|
if ( "string" == type(paths) ) then
|
|
paths = { paths }
|
|
end
|
|
|
|
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
|
local _, http_status, _ = http.identify_404(host,port)
|
|
if ( http_status == 200 ) then
|
|
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
|
return false
|
|
end
|
|
|
|
-- fallback to jmx-console
|
|
paths = paths or {"/jmx-console/"}
|
|
|
|
for _, path in ipairs(paths) do
|
|
local getstatus = http.get(host, port, path).status
|
|
|
|
-- Checks if HTTP authentication or a redirection to a login page is applied.
|
|
if getstatus == 401 or getstatus == 302 then
|
|
local headstatus = http.head(host, port, path).status
|
|
if headstatus == 500 and path == "/jmx-console/" then
|
|
-- JBoss authentication bypass.
|
|
table.insert(result, ("%s: Vulnerable to CVE-2010-0738."):format(path))
|
|
elseif headstatus == 200 then
|
|
-- Vulnerable to authentication bypass.
|
|
table.insert(result, ("%s: Authentication bypass possible"):format(path))
|
|
end
|
|
-- Checks if no authentication is required for Jmx console
|
|
-- which is default configuration and common.
|
|
elseif getstatus == 200 then
|
|
table.insert(result, ("%s: Authentication was not required"):format(path))
|
|
end
|
|
end
|
|
|
|
return stdnse.format_output(true, result)
|
|
end
|