T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2019-19781/source.pl

@@ -0,0 +1,28 @@
+#!/usr/bin/perl
+# Citrix NetScaler ADC `/vpn/portal/scripts/newbm.pl` — pre-CVE-2019-19781.
+# Authenticated bookmark creation endpoint that writes a user-supplied XML
+# template to a directory derived from the URL.  Path traversal in the
+# `url` parameter lets an unauth attacker write to /netscaler/portal/templates/
+# then trigger execution via /vpns/cfg/smb.conf with the template name.
+
+use strict;
+use warnings;
+use CGI qw(:standard);
+
+my $q   = CGI->new();
+my $url = $q->param('url');     # attacker-controlled
+my $title = $q->param('title'); # attacker-controlled XML body
+
+# BUG: $url is concatenated into the destination path without normalisation.
+# Attacker submits url=../../netscaler/portal/templates/EVIL.xml plus a
+# crafted XML body that includes a perl `print qx{...}` template tag.
+# When subsequently rendered, the qx{} executes arbitrary shell.
+my $base = '/var/vpn/bookmark/';
+my $path = $base . $url . '.xml';
+
+open(my $fh, '>', $path) or die "cannot open $path: $!";
+print $fh "<bookmark><title>$title</title></bookmark>";
+close($fh);
+
+print "Content-Type: text/plain\n\n";
+print "ok\n";