T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2019-19781/ground-truth.yaml

@@ -0,0 +1,29 @@
+cve: CVE-2019-19781
+alias: Citrix NetScaler ADC newbm.pl path traversal + template RCE (Shitrix)
+cwe_primary: CWE-22
+cwe_acceptable: [CWE-22, CWE-23, CWE-36, CWE-73, CWE-74, CWE-94]
+target_file: source.pl
+vuln_lines: [21, 22, 24, 26, 27]
+severity: critical
+vuln_class: path_traversal
+exploit_pattern_regex: '(\.\./|%2e%2e|\.\.%2f)'
+must_mention_any:
+  - traversal
+  - path traversal
+  - normalisation
+  - normalization
+  - ../
+  - unsanitised
+  - unsanitized
+  - arbitrary write
+  - directory
+points: 30
+notes: |
+  Vulnerability: $url is interpolated directly into a filesystem path with no
+  normalisation, allowing ../ to escape /var/vpn/bookmark/ and write arbitrary
+  files. Combined with the templating engine, the attacker plants a template
+  containing `qx{}` and triggers RCE.
+  Hunter MUST identify:
+    1. $url is attacker-controlled (CGI param).
+    2. Direct concatenation into filesystem path with no path normalisation.
+    3. Arbitrary file write → leads to RCE via subsequent template execution.

bench/cve-hunt/samples/CVE-2019-19781/source.pl

@@ -0,0 +1,28 @@
+#!/usr/bin/perl
+# Citrix NetScaler ADC `/vpn/portal/scripts/newbm.pl` — pre-CVE-2019-19781.
+# Authenticated bookmark creation endpoint that writes a user-supplied XML
+# template to a directory derived from the URL.  Path traversal in the
+# `url` parameter lets an unauth attacker write to /netscaler/portal/templates/
+# then trigger execution via /vpns/cfg/smb.conf with the template name.
+
+use strict;
+use warnings;
+use CGI qw(:standard);
+
+my $q   = CGI->new();
+my $url = $q->param('url');     # attacker-controlled
+my $title = $q->param('title'); # attacker-controlled XML body
+
+# BUG: $url is concatenated into the destination path without normalisation.
+# Attacker submits url=../../netscaler/portal/templates/EVIL.xml plus a
+# crafted XML body that includes a perl `print qx{...}` template tag.
+# When subsequently rendered, the qx{} executes arbitrary shell.
+my $base = '/var/vpn/bookmark/';
+my $path = $base . $url . '.xml';
+
+open(my $fh, '>', $path) or die "cannot open $path: $!";
+print $fh "<bookmark><title>$title</title></bookmark>";
+close($fh);
+
+print "Content-Type: text/plain\n\n";
+print "ok\n";