#VERSION,2.01
###############################################################################
#  Copyright (C) 2017 Chris Sullo
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; version 2
#  of the License only.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to
#  Free Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
###############################################################################
# PURPOSE:
# Check for the Apache Struts2 RCE 'strutshock' vulnerability
###############################################################################
sub nikto_strutshock_init {
    my $id = { name        => "strutshock",
               full_name   => "strutshock",
               author      => "Jeremy Bae",
               description => "Look for the 'strutshock' vulnerability.",
               hooks       => { scan => { method => \&nikto_strutshock, weight => 20 }, },
               copyright   => "2017 Chris Sullo",
             };

    return $id;
}

sub nikto_strutshock {
    my ($mark, $parameters) = @_;

    my %headers;
    $headers{'Content-Type'} = '%{#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'Nikto-Added-CVE-2017-5638\',7*6)}.multipart/form-data';

    for my $path (split(/ /, $VARIABLES{"\@STRUTSACTIONS"})) {
        my ($res, $content, $error, $request, $response) = nfetch($mark, $path, "GET", "", \%headers, "", "strutshock");
        if ($response->{'nikto-added-cve-2017-5638'} eq '42') {
            add_vulnerability($mark, "$path: Site appears vulnerable to the 'strutshock' vulnerability (CVE-2017-5638).", 999950, 0, "GET", $path, $request, $response);
        }
    }
}

1;
