🔥 Release Highlights 🔥

We’re excited to announce the expansion of the Nuclei Templates with new templates specifically for Alibaba Cloud Configurations. This release introduces a series of specialized security checks tailored for the comprehensive components of Alibaba Cloud services, including ECS instances, RDS databases, OSS buckets, and more. These new templates are crafted to pinpoint common misconfigurations, ensure compliance with regulatory standards, and maintain adherence to industry best practices, leveraging advanced features such as flow and code analysis.

The introduction of these Alibaba Cloud-specific templates empowers security teams to conduct thorough security audits of their Alibaba Cloud environments, uncovering crucial misconfigurations and vulnerabilities. Moreover, this release offers customizable checks that can be tailored to meet the unique operational demands of different teams, aiding in the prompt detection and remediation of security issues.

We encourage contributors and reviewers to provide their valuable feedback and suggestions to help enhance and evolve these Alibaba Cloud security templates further. For more details, please visit our latest blog post.

Other Highlights

• [CVE-2024-55956] Cleo Harmony < 5.8.0.24 - File Upload Vulnerability (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
• [CVE-2024-52875] Kerio Control v9.2.5 - CRLF Injection (@ritikchaddha, @iamnoooob, @rootxharsh, @pdresearch) [high] 🔥
• [CVE-2024-50623] Cleo Harmony < 5.8.0.21 - Arbitary File Read (@DhiyaneshDK) [high] 🔥
• [CVE-2024-45309] OneDev.io < 11.0.9 - Arbitrary File Read (@isacaya) [high] 🔥
• [CVE-2024-41713] Mitel MiCollab - Authentication Bypass (@DhiyaneshDK, @watchTowr) [high] 🔥
• [CVE-2024-36404] GeoServer and GeoTools - Remote Code Execution (@ritikchaddha) [critical] 🔥
• [CVE-2024-12209] WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion (@s4e-io) [critical] 🔥
• [CVE-2024-8856] WP Time Capsule Plugin - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
• [CVE-2020-15906] TikiWiki GroupWare - Auth Bypass (@JeonSungHyun, @gy741, @oIfloraIo, @nechyo, @harksu) [critical] 🔥
• [CVE-2020-13935] Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service (@sttlr) [high] 🔥
• [CVE-2017-1000353] Jenkins CLI - Java Deserialization (@hnd3884) [critical] 🔥

What's Changed

New Templates Added: 154 | CVEs Added: 31 | First-time contributions: 4

• [CVE-2024-55956] Cleo Harmony < 5.8.0.24 - File Upload Vulnerability (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
• [CVE-2024-52875] Kerio Control v9.2.5 - CRLF Injection (@ritikchaddha, @iamnoooob, @rootxharsh, @pdresearch) [high] 🔥
• [CVE-2024-52433] My Geo Posts Free <= 1.2 - PHP Object Injection (@s4e-io) [critical]
• [CVE-2024-50623] Cleo Harmony < 5.8.0.21 - Arbitary File Read (@DhiyaneshDK) [high] 🔥
• [CVE-2024-48307] JeecgBoot v3.7.1 - SQL Injection (@lbb, @s4e-io) [critical]
• [CVE-2024-45309] OneDev.io < 11.0.9 - Arbitrary File Read (@isacaya) [high] 🔥
• [CVE-2024-45293] TablePress < 2.4.3 - XXE Injection (@iamnoooob, @ritikchaddha) [high]
• [CVE-2024-41713] Mitel MiCollab - Authentication Bypass (@DhiyaneshDK, @watchTowr) [high] 🔥
• [CVE-2024-39887] Apache Superset < 4.0.2 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [medium]
• [CVE-2024-36404] GeoServer and GeoTools - Remote Code Execution (@ritikchaddha) [critical] 🔥
• [CVE-2024-24116] Ruijie RG-NBS2009G-P - Improper Authentication (@friea) [critical]
• [CVE-2024-12209] WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion (@s4e-io) [critical] 🔥
• [CVE-2024-11728] KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection (@samogod, @s4e-io) [high]
• [CVE-2024-11305] Altenergy Power Control Software - SQL Injection (@s4e-io) [medium]
• [CVE-2024-11303] Korenix JetPort 5601v3 - Path Traversal (@geeknik) [high]
• [CVE-2024-10516] Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion (@ritikchaddha) [high]
• [CVE-2024-10400] Tutor LMS <= 2.7.6 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [high]
• [CVE-2024-8859] Mlflow < 2.17.0 - Local File Inclusion (@gy741) [critical]
• [CVE-2024-8856] WP Time Capsule Plugin - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
• [CVE-2023-50094] reNgine 2.2.0 - Command Injection (@Zierax) [high]
• [CVE-2023-46455] GL.iNet <= 4.3.7 - Arbitrary File Write (@Zierax) [high]
• [CVE-2023-37599] Issabel PBX 4.0.0-6 - Directory Listing (@ritikchaddha) [high]
• [CVE-2023-6697] WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting (@iamnoooob, @ritikchaddha) [medium]
• [CVE-2023-3990] Mingsoft MCMS < 5.3.1 - Cross-Site Scripting (@ritikchaddha) [medium]
• [CVE-2023-1119] WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting (@ritikchaddha) [medium]
• [CVE-2022-4375] Mingsoft MCMS - SQL Injection (@ritikchaddha) [critical]
• [CVE-2022-2552] Duplicator < 1.4.7.1 - Information Disclosure (@iamnoooob, @ritikchaddha) [medium]
• [CVE-2020-15906] Tiki Wiki CMS GroupWare - Authentication Bypass (@JeonSungHyun[nukunga], @gy741, @oIfloraIo, @nechyo, @harksu) [critical] 🔥
• [CVE-2020-13935] Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service (@sttlr) [high] 🔥
• [CVE-2019-9912] WP Google Maps < 7.10.43 - Cross-Site Scripting (@ritikchaddha) [medium]
• [CVE-2017-1000353] Jenkins CLI - Java Deserialization (@hnd3884) [critical] 🔥
• [ack-cluster-api-public] Public Access to ACK Cluster's API Server - Enabled (@ritikchaddha) [high]
• [ack-cluster-auditing-disable] Cluster Auditing with Simple Log Service - Disabled (@ritikchaddha) [low]
• [ack-cluster-cloud-monitor-disable] Cloud Monitor for ACK Clusters - Disable (@ritikchaddha) [medium]
• [ack-cluster-health-disable] ACK Clusters Check - Disable (@ritikchaddha) [medium]
• [ack-cluster-network-policies-disable] Enforced Cluster Support for Network Policies - Disabled (@ritikchaddha) [medium]
• [ack-cluster-network-policies-missing] Cluster Support for Network Policies - Missing (@ritikchaddha) [medium]
• [kubernetes-dashboard-enabled] Kubernetes Dashboard for ACK Clusters - Enabled (@ritikchaddha) [medium]
• [multi-region-logging-disabled] Global Service (Multi-Region) Logging - Disabled (@DhiyaneshDK) [high]
• [public-actiontrail-bucket] ActionTrail Log Buckets - Publicly Exposed (@ritikchaddha) [high]
• [alibaba-cloud-code-env] Alibaba Cloud Environment Validation (@DhiyaneshDK) [info]
• [os-patches-outdated] OS Patches - Outdated (@DhiyaneshDK) [medium]
• [unattached-disk-encryption-disabled] Encryption for Unattached Disks - Disabled (@DhiyaneshDK) [high]
• [unattached-vminstance-encryption-disabled] Encryption for VM Instance Disks - Disabled (@DhiyaneshDK) [high]
• [unrestricted-rdp-access] Unrestricted - RDP Access (@DhiyaneshDK) [high]
• [unrestricted-ssh-access] Unrestricted - SSH Access (@DhiyaneshDK) [high]
• [access-logoss-disabled] Access Logging for OSS Buckets - Disabled (@DhiyaneshDK) [medium]
• [improper-bucket-sse] Improper Bucket Server-Side Encryption (@ritikchaddha) [medium]
• [limit-networkaccess-disabled] Limit Network Access to Selected Networks - Disabled (@DhiyaneshDK) [medium]
• [oos-bucket-public-access] OSS Bucket Public Accessible (@DhiyaneshDK) [high]
• [secure-transfeross-disabled] Secure Transfer for OSS Buckets - Disabled (@DhiyaneshDK) [medium]
• [sse-cmk-disabled] Server-Side Encryption with Customer Managed Key - Disabled (@ritikchaddha) [high]
• [sse-smk-disabled] Server-Side Encryption with Service Managed Key - Disabled (@ritikchaddha) [high]
• [custom-ram-policy-admin-priv] Custom RAM Policies With Full Administrative Privileges (@DhiyaneshDK) [high]
• [max-password-retry-disabled] Maximum Password Retry Constraint Policy - Disabled (@DhiyaneshDK) [medium]
• [mfa-console-password-disabled] MFA For RAM Users With Console Password - Disabled (@DhiyaneshDK) [medium]
• [password-policy-expiration-unconfigured] RAM Password Policy Expiration - Unconfigured (@DhiyaneshDK) [medium]
• [password-policy-length-unconfigured] RAM Password Policy requires Minimum Length 14 or Greater (@DhiyaneshDK) [medium]
• [password-policy-lowercase-unconfigured] RAM Password Policy requires atleast One Lowercase - Unconfigured (@DhiyaneshDK) [medium]
• [password-policy-num-unconfigured] RAM Password Policy requires atleast One Number - Unconfigured (@DhiyaneshDK) [medium]
• [password-policy-reuse-enabled] RAM Password Policy Reuse - Enabled (@DhiyaneshDK) [medium]
• [password-policy-symbol-unconfigured] RAM Password Policy requires atleast One Symbol - Unconfigured (@DhiyaneshDK) [medium]
• [password-policy-uppercase-unconfigured] RAM Password Policy requires atleast One Uppercase - Unconfigured (@DhiyaneshDK) [medium]
• [encryption-intransit-disabled] RDS Encryption in Transit - Disabled (@DhiyaneshDK) [high]
• [log-connections-disabled] PostgreSQL "log_connections" Parameter - Disabled (@DhiyaneshDK) [medium]
• [log-disconnections-disabled] PostgreSQL "log_disconnections" Parameter - Disabled (@DhiyaneshDK) [medium]
• [log-duration-disabled] PostgreSQL "log_duration" Parameter - Disabled (@DhiyaneshDK) [medium]
• [mssql-audit-disabled] Microsoft SQLServer Database Instances - SQL Auditing Disabled (@DhiyaneshDK) [high]
• [mysql-audit-disabled] MySQL Database Instances - SQL Auditing Disabled (@DhiyaneshDK) [high]
• [postgresql-audit-disabled] PostgreSQL Database Instances - SQL Auditing Disabled (@DhiyaneshDK) [high]
• [rds-audit-disabled] RDS Database Instances - SQL Auditing Disabled (@DhiyaneshDK) [high]
• [transparent-encryption-disabled] Transparent Data Encryption - Disabled (@DhiyaneshDK) [medium]
• [scheduled-vulnscan-disabled] Scheduled Vulnerability Scan - Disabled (@DhiyaneshDK) [medium]
• [security-notification-disabled] Security Center Notifications - Disabled (@DhiyaneshDK) [medium]
• [security-plan-disabled] Security Center Plan - Disabled (@DhiyaneshDK) [medium]
• [vpc-flow-disabled] VPC Flow Log - Disabled (@DhiyaneshDK) [medium]
• [elb-delete-protection-disabled] ELB Delete Protection - Disabled (@DhiyaneshDK) [medium]
• [sqs-deadletter-disabled] SQS Dead Letter Queue - Disabled (@DhiyaneshDK) [medium]
• [sqs-encryption-disabled] Queue Server Side Encryption - Disabled (@DhiyaneshDK) [high]
• [sqs-queue-exposed] SQS Queue Exposed (@DhiyaneshDK) [high]
• [blade-oob] Laravel Blade 11.27.2 - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [bottle-oob] Bottle - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [chameleon-oob] Chameleon - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [dotjs-oob] DotJS - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [ejs-underscore-oob] Ejs AND Underscore - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [erb-erubi-erubis-oob] Erb OR Erubi OR Erubis - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [freemarker-oob] Freemarker 2.3.33 - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [groovy-oob] Groovy - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [jinja2-oob] Jinja2 - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [latte-oob] Latte 3.0.20 - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [mako-oob] Mako - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [pugjs-oob] Pug.js - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [tornado-oob] Tornado - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [velocityjs-oob] VelocityJS 2.0.6 - Out of Band Template Injection (@0xAwali, @DhiyaneshDK) [unknown]
• [huginn-panel] Huginn Login Panel - Detect (@righettod) [info]
• [openobserve-panel] OpenObserve Login Panel - Detect (@righettod) [info]
• [ricoh-webimagemonitor-panel] Ricoh Web Image Monitor - Detect (@righettod) [info]
• [backup-directory-listing] Backup Directory Listing - Detect (@DhiyaneshDK) [low]
• [exposed-pki-cert] Exposed Internal PKI Infrastructure - Detect (@nullenc0de) [high]
• [rapidapi-access-token] RapidAPI Access Token (@DhiyaneshDK) [info]
• [readme-api-token] Readme API Token (@DhiyaneshDK) [info]
• [scalingo-api-token] Scalingo API Token (@DhiyaneshDK) [info]
• [sendbird-access-id] SendBird Access ID (@DhiyaneshDK) [info]
• [sendbird-access-token] SendBird Access Token (@DhiyaneshDK) [info]
• [sendinblue-api-token] Sendinblue API Token (@DhiyaneshDK) [info]
• [sentry-access-token] Sentry Access Token (@DhiyaneshDK) [info]
• [shippo-api-token] Shippo API Token (@DhiyaneshDK) [info]
• [shopify-private-app-access-token] Shopify Private App Access Token (@DhiyaneshDK) [info]
• [shopify-shared-secret] Shopify Shared Secret (@DhiyaneshDK) [info]
• [sidekiq-secret] Sidekiq Secret Token (@DhiyaneshDK) [info]
• [sidekiq-sensitive-url] Sidekiq Sensitive URL (@DhiyaneshDK) [info]
• [slack-app-token] Slack App Token (@DhiyaneshDK) [info]
• [slack-config-access-token] Slack Config Access Token (@DhiyaneshDK) [info]
• [slack-config-refresh-token] Slack Config Refresh Token (@DhiyaneshDK) [info]
• [slack-legacy-bot-token] Slack Legacy Bot Token (@DhiyaneshDK) [info]
• [slack-legacy-token] Slack Legacy Token (@DhiyaneshDK) [info]
• [slack-legacy-workspace-token] Slack Legacy Workspace Token (@DhiyaneshDK) [info]
• [squarespace-access-token] Squarespace Access Token (@DhiyaneshDK) [info]
• [stripe-access-token] Stripe Access Token (@DhiyaneshDK) [info]
• [sumologic-access-id] Sumologic Access ID (@DhiyaneshDK) [info]
• [sumologic-access-token] Sumologic Access Token (@DhiyaneshDK) [info]
• [snyk-api-token] Snyk API Token (@DhiyaneshDK) [info]
• [travisci-access-token] TravisCI Access Token (@DhiyaneshDK) [info]
• [twitch-api-token] Twitch API Secret Token (@DhiyaneshDK) [info]
• [twitter-api-key] Twitter API Key (@DhiyaneshDK) [info]
• [twitter-api-secret] Twitter API Secret Token (@DhiyaneshDK) [info]
• [twitter-bearer-token] Twitter Bearer Token (@DhiyaneshDK) [info]
• [typeform-api-token] Typeform API Token (@DhiyaneshDK) [info]
• [vault-batch-token] Vault Batch Token (@DhiyaneshDK) [info]
• [vault-service-token] Vault Service Token (@DhiyaneshDK) [info]
• [yandex-access-token] Yandex Access Token (@DhiyaneshDK) [info]
• [yandex-api-key] Yandex API Key (@DhiyaneshDK) [info]
• [yandex-aws-access-token] Yandex AWS Access Token (@DhiyaneshDK) [info]
• [cleo-detect] Cleo Technology - Detect (@rxerium) [info]
• [hue-wireless-lighting] Hue Personal Wireless Lighting - Detect (@ProjectDiscoveryAI) [info]
• [wordpress-hunk-companion] Hunk Companion Detection (@invisiblethreat) [info]
• [api-jotform] Jotform API Test (@0xpugal) [info]
• [dlink-nas-rce] D-Link NAS sc_mgr.cgi - Remote Code Execution (@adeljck) [critical]
• [feiyuxing-ent-router-infoleak] FeiYuXing Enterprise Router - Information Leakage (@adeljck) [high]
• [infinitt-pacs-file-upload] Infinitt PACS System - Arbitary File Upload (@adeljck) [critical]
• [infinitt-pacs-info-disclosure] Infinitt PACS System - Information Disclosure (@adeljck) [high]
• [mcms-list-sqli] Mingsoft MCMS 5.2.1 - SQL Injection (@ritikchaddha) [critical]
• [mitel-arbitary-file-read] Mitel MiCollab - Arbitary File Read (@DhiyaneshDk, @watchTowr) [critical]
• [aishu-anyshare-info-exposure] Aishu AnyShare - Information Disclosure (@s4e-io) [high]
• [easycvr-arbitrary-file-read] EasyCVR Video Management - Arbitrary File Read (@s4e-io) [high]
• [mcms-search-xss] Mingsoft MCMS < 5.3.1 - Cross-Site Scripting (@ritikchaddha) [medium]
• [vrview-xss] VRview Plugin - Cross-Site Scripting (@ritikchaddha) [high]
• [wp-vr-view-xss] WP VR-View Plugin - Cross-Site Scripting (@ritikchaddha) [high]
• [fortianalyzer-certificate] Fortinet FortiAnalyzer Certificate - Detect (@johnk3r) [info]
• [fortiauthenticator-certificate] Fortinet FortiAuthenticator Certificate - Detect (@johnk3r) [info]
• [fortiddos-certificate] Fortinet FortiDDoS Certificate - Detect (@johnk3r) [info]
• [fortigate-certificate] Fortinet FortiGate Certificate - Detect (@johnk3r) [info]
• [fortimanager-certificate] Fortinet FortiManager Certificate - Detect (@johnk3r) [info]
• [fortiwifi-certificate] Fortinet FortiWifi Certificate - Detect (@johnk3r) [info]

New Contributors

• @Zierax made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/11144
• @friea-p made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/11267
• @nukunga made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/10577
• @stealthcopter made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/11397

Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v10.1.0...v10.1.1