<commit_before>/*
 * Copyright 2021 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.google.tsunami.plugins.detectors.cves.cve202122205;

import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.collect.ImmutableList.toImmutableList;
import static com.google.common.net.HttpHeaders.CONTENT_TYPE;
import static com.google.common.net.HttpHeaders.COOKIE;
import static com.google.common.net.HttpHeaders.USER_AGENT;
import static com.google.tsunami.common.data.NetworkEndpointUtils.toUriAuthority;
import static com.google.tsunami.common.net.http.HttpRequest.get;
import static com.google.tsunami.common.net.http.HttpRequest.post;

import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.Strings;
import com.google.common.collect.ImmutableList;
import com.google.common.flogger.GoogleLogger;
import com.google.common.io.BaseEncoding;
import com.google.protobuf.ByteString;
import com.google.protobuf.util.Timestamps;
import com.google.tsunami.common.data.NetworkServiceUtils;
import com.google.tsunami.common.net.http.HttpClient;
import com.google.tsunami.common.net.http.HttpHeaders;
import com.google.tsunami.common.net.http.HttpResponse;
import com.google.tsunami.common.time.UtcClock;
import com.google.tsunami.plugin.PluginType;
import com.google.tsunami.plugin.VulnDetector;
import com.google.tsunami.plugin.annotations.PluginInfo;
import com.google.tsunami.proto.DetectionReport;
import com.google.tsunami.proto.DetectionReportList;
import com.google.tsunami.proto.DetectionStatus;
import com.google.tsunami.proto.NetworkService;
import com.google.tsunami.proto.Severity;
import com.google.tsunami.proto.TargetInfo;
import com.google.tsunami.proto.Vulnerability;
import com.google.tsunami.proto.VulnerabilityId;
import java.io.IOException;
import java.time.Clock;
import java.time.Instant;
import java.util.Iterator;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.inject.Inject;

/** A {@link VulnDetector} that detects the CVE-2021-22205 vulnerability. */
@PluginInfo(
    type = PluginType.VULN_DETECTION,
    name = "CVE202122205VulnDetector",
    version = "0.1",
    description = Cve202122205VulnDetector.VULN_DESCRIPTION,
    author = "hh-hunter",
    bootstrapModule = Cve202122205DetectorBootstrapModule.class)
public final class Cve202122205VulnDetector implements VulnDetector {
  private static final GoogleLogger logger = GoogleLogger.forEnclosingClass();
  private static final String USER_SIGN_PATH = "users/sign_in";
  private static final String VUL_PATH = "uploads/user";
  private static final Pattern CSRF_TOKEN_PATTERN =
      Pattern.compile("csrf-token\" content=\"(.*?)\" />\\n\\n<meta");
  /**
   * The detailed principle of Poc generation for the vulnerability can be found in the following
   * article devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html
   * https://github.com/mr-r3bot/Gitlab-CVE-2021-22205 I generated a Poc locally, executed the
   * command TSUNAMI_SCANNER (placeholder), and then converted the PoC to hexadecimal. When sending
   * data, I only need to convert the hexadecimal code to a string. Please note that this Payload
   * has been streamlined and can only be used for PoC verification and cannot be exploited
   */
  private static final String POST_DATA =
      "0D0A2D2D2D2D2D2D5765624B6974466F726D426F756E64617279494D76336D7852673539546B465358350D0A436F"
          + "6E74656E742D446973706F736974696F6E3A20666F726D2D646174613B206E616D653D2266696C65223B20"
          + "66696C656E616D653D22746573742E6A7067220D0A436F6E74656E742D547970653A20696D6167652F6A70"<commit_msg>Update the pattern matching to be more permissive in CSRF token for cve-2021-22205 detector.<commit_after>/*
 * Copyright 2021 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.google.tsunami.plugins.detectors.cves.cve202122205;

import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.collect.ImmutableList.toImmutableList;
import static com.google.common.net.HttpHeaders.CONTENT_TYPE;
import static com.google.common.net.HttpHeaders.COOKIE;
import static com.google.common.net.HttpHeaders.USER_AGENT;
import static com.google.tsunami.common.data.NetworkEndpointUtils.toUriAuthority;
import static com.google.tsunami.common.net.http.HttpRequest.get;
import static com.google.tsunami.common.net.http.HttpRequest.post;

import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.Strings;
import com.google.common.collect.ImmutableList;
import com.google.common.flogger.GoogleLogger;
import com.google.common.io.BaseEncoding;
import com.google.protobuf.ByteString;
import com.google.protobuf.util.Timestamps;
import com.google.tsunami.common.data.NetworkServiceUtils;
import com.google.tsunami.common.net.http.HttpClient;
import com.google.tsunami.common.net.http.HttpHeaders;
import com.google.tsunami.common.net.http.HttpResponse;
import com.google.tsunami.common.time.UtcClock;
import com.google.tsunami.plugin.PluginType;
import com.google.tsunami.plugin.VulnDetector;
import com.google.tsunami.plugin.annotations.PluginInfo;
import com.google.tsunami.proto.DetectionReport;
import com.google.tsunami.proto.DetectionReportList;
import com.google.tsunami.proto.DetectionStatus;
import com.google.tsunami.proto.NetworkService;
import com.google.tsunami.proto.Severity;
import com.google.tsunami.proto.TargetInfo;
import com.google.tsunami.proto.Vulnerability;
import com.google.tsunami.proto.VulnerabilityId;
import java.io.IOException;
import java.time.Clock;
import java.time.Instant;
import java.util.Iterator;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.inject.Inject;

/** A {@link VulnDetector} that detects the CVE-2021-22205 vulnerability. */
@PluginInfo(
    type = PluginType.VULN_DETECTION,
    name = "CVE202122205VulnDetector",
    version = "0.1",
    description = Cve202122205VulnDetector.VULN_DESCRIPTION,
    author = "hh-hunter",
    bootstrapModule = Cve202122205DetectorBootstrapModule.class)
public final class Cve202122205VulnDetector implements VulnDetector {
  private static final GoogleLogger logger = GoogleLogger.forEnclosingClass();
  private static final String USER_SIGN_PATH = "users/sign_in";
  private static final String VUL_PATH = "uploads/user";
  // CSRF token looks like <meta name="csrf-token" content="ABCE" />
  private static final Pattern CSRF_TOKEN_PATTERN =
      Pattern.compile("csrf-token\" content=\"(.*?)\" />");

  /**
   * The detailed principle of Poc generation for the vulnerability can be found in the following
   * article devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html
   * https://github.com/mr-r3bot/Gitlab-CVE-2021-22205 I generated a Poc locally, executed the
   * command TSUNAMI_SCANNER (placeholder), and then converted the PoC to hexadecimal. When sending
   * data, I only need to convert the hexadecimal code to a string. Please note that this Payload
   * has been streamlined and can only be used for PoC verification and cannot be exploited
   */
  private static final String POST_DATA =
      "0D0A2D2D2D2D2D2D5765624B6974466F726D426F756E64617279494D76336D7852673539546B465358350D0A436F"
          + "6E74656E742D446973706F736974696F6E3A20666F726D2D646174613B206E616D653D2266696C65223B20"
          + "66696C656E616D653D22746573742E6A7067220D0A436F6E74656E742D547970653A20696D6167652F6A70"
{'fraction_non_alphanumeric': 0.08994833255049318, 'fraction_numerical': 0.07245185533114139, 'mean_word_length': 5.2032046613255645, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 6, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4633788', 'n_tokens_mistral': 3097, 'n_tokens_neox': 2737, 'n_words': 618}