From 7eec4bf62b9b2d1d2e43f42b54ee31c0a5f3297d Mon Sep 17 00:00:00 2001 From: AmirHossein Raeisi <96957814+Ahsraeisi@users.noreply.github.com> Date: Thu, 18 Apr 2024 06:19:32 +0000 Subject: [PATCH] fix template validation action --- templates/12.6.1.yaml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/templates/12.6.1.yaml b/templates/12.6.1.yaml index 7f94aa6..bc6f561 100644 --- a/templates/12.6.1.yaml +++ b/templates/12.6.1.yaml @@ -3,7 +3,7 @@ id: ASVS-4-0-3-V12-6-1 info: name: ASVS 12.6.1 Check author: AmirHossein Raeisi - severity: high + severity: high classification: cwe-id: CWE-918 reference: @@ -14,13 +14,12 @@ info: description: | Verify that the web or application server is configured with an allow list of resources or systems to which the server can send requests or load data/files from. -variables: +variables: whiltelist_host: "http://google.com" server_file: "file:///etc/passwd" - restricted_path: "/admin" + restricted_path: "/admin" restricted_path_keyword: "Welcom to Admin Panel" - requests: - raw: - | @@ -35,7 +34,7 @@ requests: - type: regex regex: - "root:[x*]:0:0:" - + - raw: - | POST {{BaseURL}} HTTP/1.1 @@ -50,7 +49,7 @@ requests: Content-Type: application/json {"url":"{{whiltelist_host}}.{{interactsh-url}}"} - + - | POST {{BaseURL}} HTTP/1.1 Host: {{Hostname}} @@ -73,7 +72,6 @@ requests: - "http" - "dns" - - raw: - | POST {{BaseURL}} HTTP/1.1 @@ -108,10 +106,9 @@ requests: - '127.0x0.0x0.0x1' - '2130706433' - stop-at-first-match: true matchers: - type: word words: - - "{{restricted_path_keyword}}" + - "{{restricted_path_keyword}}" \ No newline at end of file