CVE-2023-3519.yaml

id: cve-2023-3519
info:
  name: CVE-2023-3519 Vulnerability Check
  author: Dhiraj Mishra (@RandomDhiraj)
  severity: high
  description: |
    Checks target for CVE-2023-3519 vulnerability.
    Compares "Last-Modified" header in the server response to known patched versions.
  references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3519
    - https://twitter.com/DTCERT/status/1682032701430452233
tags:
  - safe
  - vuln
requests:
  - method: GET
    path: /
    port: ssl
    matchers:
      - type: word
        words:
          - "Patched version detected"
      - type: not
        words:
          - "Potentially vulnerable"
    headers:
      User-Agent: nuclei-templates
      Connection: close
      Accept-Encoding: gzip, deflate
      Accept: "*/*"
    tests:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Last-Modified"
      - type: regex
        regex:
          - 'Last-Modified:\s*(.*)'
        matchers:
          - type: group
            index: 1
            extractors:
              - type: text
                regex:
                  - '.*'
                group: 0
            match: patched
      - type: metadata
        requirements:
          - patched
        operators:
          - type: compare
            operator: contains
            value:
              - "Patched version detected"