From 60c1719b6d75bde76067e8dc482590263a2cfeb0 Mon Sep 17 00:00:00 2001 From: beatz174-bit Date: Mon, 13 Apr 2026 10:38:15 +1000 Subject: [PATCH] Add CVE triage and disposition artifacts for scan hits --- build-cve-triage.py | 248 ++++++++++++++++++ results/_false_positive_suppressions.json | 38 +++ .../scans/_cve_disposition.json | 67 +++++ .../scans/_cve_triage.md | 10 + .../scans/_cve_disposition.json | 93 +++++++ .../scans/_cve_triage.md | 12 + .../scans/_cve_disposition.json | 30 +++ .../scans/_cve_triage.md | 8 + .../scans/_cve_disposition.json | 32 +++ .../scans/_cve_triage.md | 8 + .../scans/_cve_disposition.json | 32 +++ .../scans/_cve_triage.md | 8 + .../scans/_cve_disposition.json | 127 +++++++++ .../scans/_cve_triage.md | 14 + .../scans/_cve_disposition.json | 38 +++ .../scans/_cve_triage.md | 8 + .../scans/_cve_disposition.json | 37 +++ .../scans/_cve_triage.md | 8 + 18 files changed, 818 insertions(+) create mode 100755 build-cve-triage.py create mode 100644 results/_false_positive_suppressions.json create mode 100644 results/auth.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/auth.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/familytree.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/familytree.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/kuma.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/kuma.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/nextcloud.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/nextcloud.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/prometheus.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/prometheus.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/shifts.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/shifts.lan.ddnsgeek.com/scans/_cve_triage.md create mode 100644 results/stockfill.lan.ddnsgeek.com/scans/_cve_disposition.json create mode 100644 results/stockfill.lan.ddnsgeek.com/scans/_cve_triage.md diff --git a/build-cve-triage.py b/build-cve-triage.py new file mode 100755 index 0000000..c644213 --- /dev/null +++ b/build-cve-triage.py @@ -0,0 +1,248 @@ +#!/usr/bin/env python3 +"""Build CVE triage sheets from AutoRecon artifacts.""" +from __future__ import annotations + +import json +import re +from collections import defaultdict +from datetime import datetime, timezone +from pathlib import Path + +RESULTS_DIR = Path("results") +CVE_RE = re.compile(r"CVE-\d{4}-\d{4,7}") +OPEN_PORT_RE = re.compile(r"^(\d+/(?:tcp|udp))\s+open\s+(.*)$") +SCRIPT_URL_RE = re.compile(r"\|\s+(/[^: ]*):\s+(.*CVE-\d{4}-\d{4,7}.*)$") + +PRECONDITIONS = { + "CVE-2011-3192": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.", + "CVE-2009-3733": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.", + "CVE-2011-0966": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.", + "CVE-2018-10822": "Target must be affected D-Link router firmware exposing /uir/ traversal path.", + "CVE-2018-10824": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.", + "CVE-2017-9798": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.", + "CVE-2005-3299": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.", + "CVE-2003-1418": "Target must expose Apache mod_include with vulnerable SSI execution behavior.", +} + +REQUIRED_REPRO_STEP = ( + "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, " + "or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient." +) + + +def load_text(path: Path) -> str: + try: + return path.read_text(encoding="utf-8", errors="ignore") + except FileNotFoundError: + return "" + + +def parse_service_evidence(nmap_paths: list[Path]) -> dict[str, list[str]]: + evidence: dict[str, list[str]] = defaultdict(list) + for path in nmap_paths: + for line in load_text(path).splitlines(): + m = OPEN_PORT_RE.match(line.strip()) + if m: + endpoint = m.group(1) + value = m.group(2).strip() + if value and value not in evidence[endpoint]: + evidence[endpoint].append(value) + return dict(evidence) + + +def parse_nmap_hits(nmap_paths: list[Path]) -> dict[str, list[dict[str, str]]]: + hits: dict[str, list[dict[str, str]]] = defaultdict(list) + for path in nmap_paths: + lines = load_text(path).splitlines() + current_endpoint = "unknown" + for idx, line in enumerate(lines): + stripped = line.strip() + m_open = OPEN_PORT_RE.match(stripped) + if m_open: + current_endpoint = m_open.group(1) + for cve in CVE_RE.findall(line): + endpoint = current_endpoint + detail = stripped + m_url = SCRIPT_URL_RE.search(line) + if m_url: + endpoint = m_url.group(1) + detail = m_url.group(2) + # include short context for review + ctx = "\n".join(lines[max(0, idx - 1): min(len(lines), idx + 2)]) + hits[cve].append( + { + "source_file": str(path), + "endpoint": endpoint, + "evidence": detail, + "context": ctx, + } + ) + return dict(hits) + + +def parse_pattern_hits(pattern_path: Path) -> dict[str, int]: + counts: dict[str, int] = defaultdict(int) + for line in load_text(pattern_path).splitlines(): + for cve in CVE_RE.findall(line): + counts[cve] += 1 + return dict(counts) + + +def infer_status(cve: str, evidence_blob: str) -> tuple[str, str]: + blob = evidence_blob.lower() + if "401 unauthorized" in blob: + return ( + "not-applicable", + "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + ) + if cve in {"CVE-2017-9798", "CVE-2003-1418"}: + return ( + "needs-manual-test", + "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.", + ) + return ( + "needs-manual-test", + "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + ) + + +def host_dirs() -> list[Path]: + return sorted([p for p in RESULTS_DIR.iterdir() if p.is_dir() and (p / "scans").exists()]) + + +def main() -> None: + generated = datetime.now(timezone.utc).isoformat() + global_suppressions = [] + + for host_dir in host_dirs(): + scans_dir = host_dir / "scans" + pattern_path = scans_dir / "_patterns.log" + nmap_paths = sorted(scans_dir.glob("**/*nmap*.txt")) + if not pattern_path.exists() and not nmap_paths: + continue + + pattern_counts = parse_pattern_hits(pattern_path) + nmap_hits = parse_nmap_hits(nmap_paths) + cves = sorted(set(pattern_counts) | set(nmap_hits)) + if not cves: + continue + + service_evidence = parse_service_evidence(nmap_paths) + host_entries = [] + + for cve in cves: + hit_entries = nmap_hits.get(cve, []) + endpoints = sorted({h["endpoint"] for h in hit_entries if h["endpoint"]}) or ["unknown"] + endpoint = endpoints[0] + + product_versions = [] + for ep, products in service_evidence.items(): + if ep in endpoint or endpoint in ep or endpoint == "unknown": + product_versions.extend(products) + product_versions = sorted(set(product_versions)) + if not product_versions: + product_versions = ["No explicit product/version fingerprint in nmap service line."] + + evidence_blob = "\n".join([h["evidence"] for h in hit_entries]) + status, rationale = infer_status(cve, evidence_blob) + reproducibility = ( + "not-reproduced" if status != "confirmed" else "reproduced" + ) + + sources = [] + if pattern_counts.get(cve, 0): + sources.append({"file": str(pattern_path), "match_count": pattern_counts[cve]}) + for h in hit_entries: + sources.append( + { + "file": h["source_file"], + "endpoint": h["endpoint"], + "evidence": h["evidence"], + } + ) + + entry = { + "host": host_dir.name, + "cve": cve, + "affected_host": host_dir.name, + "endpoint": endpoint, + "product_version_evidence": product_versions, + "exploit_precondition": PRECONDITIONS.get( + cve, + "Validate affected product/version and exploit path prerequisites before filing.", + ), + "reproducibility": reproducibility, + "disposition": status, + "disposition_rationale": rationale, + "required_reproduction_step_before_ticket": REQUIRED_REPRO_STEP, + "evidence_sources": sources, + } + host_entries.append(entry) + + if status == "not-applicable": + global_suppressions.append( + { + "host": host_dir.name, + "signature": cve, + "reason": rationale, + "suppression_scope": "host-specific", + "source": "cve-triage", + "updated_at": generated, + } + ) + + host_entries.sort(key=lambda item: item["cve"]) + + md_lines = [ + f"# CVE triage sheet - {host_dir.name}", + "", + f"Generated (UTC): {generated}", + "", + "| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |", + "|---|---|---|---|---|---|---|", + ] + + for item in host_entries: + evidence_short = "; ".join(item["product_version_evidence"][:2]) + md_lines.append( + f"| {item['cve']} | {item['affected_host']} | `{item['endpoint']}` | {evidence_short} | {item['exploit_precondition']} | {item['reproducibility']} | **{item['disposition']}** |" + ) + md_lines.append( + f"| | | | | | | Required reproduction gate: {item['required_reproduction_step_before_ticket']} |" + ) + + (scans_dir / "_cve_triage.md").write_text("\n".join(md_lines) + "\n", encoding="utf-8") + (scans_dir / "_cve_disposition.json").write_text( + json.dumps( + { + "host": host_dir.name, + "generated_at": generated, + "required_reproduction_step_before_ticket": REQUIRED_REPRO_STEP, + "findings": host_entries, + }, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + + if global_suppressions: + (RESULTS_DIR / "_false_positive_suppressions.json").write_text( + json.dumps( + { + "generated_at": generated, + "description": "Host-level CVE suppressions derived from triage dispositions.", + "suppressions": sorted( + global_suppressions, + key=lambda item: (item["host"], item["signature"]), + ), + }, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + + +if __name__ == "__main__": + main() diff --git a/results/_false_positive_suppressions.json b/results/_false_positive_suppressions.json new file mode 100644 index 0000000..02a19fb --- /dev/null +++ b/results/_false_positive_suppressions.json @@ -0,0 +1,38 @@ +{ + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "description": "Host-level CVE suppressions derived from triage dispositions.", + "suppressions": [ + { + "host": "prometheus.lan.ddnsgeek.com", + "signature": "CVE-2009-3733", + "reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "suppression_scope": "host-specific", + "source": "cve-triage", + "updated_at": "2026-04-07T03:49:38.723646+00:00" + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "signature": "CVE-2011-0966", + "reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "suppression_scope": "host-specific", + "source": "cve-triage", + "updated_at": "2026-04-07T03:49:38.723646+00:00" + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "signature": "CVE-2018-10822", + "reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "suppression_scope": "host-specific", + "source": "cve-triage", + "updated_at": "2026-04-07T03:49:38.723646+00:00" + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "signature": "CVE-2018-10824", + "reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "suppression_scope": "host-specific", + "source": "cve-triage", + "updated_at": "2026-04-07T03:49:38.723646+00:00" + } + ] +} diff --git a/results/auth.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/auth.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..ad08666 --- /dev/null +++ b/results/auth.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,67 @@ +{ + "host": "auth.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "auth.lan.ddnsgeek.com", + "cve": "CVE-2005-3299", + "affected_host": "auth.lan.ddnsgeek.com", + "endpoint": "443/tcp", + "product_version_evidence": [ + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)" + ], + "exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| IDs: CVE:CVE-2005-3299" + }, + { + "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299" + } + ] + }, + { + "host": "auth.lan.ddnsgeek.com", + "cve": "CVE-2009-3733", + "affected_host": "auth.lan.ddnsgeek.com", + "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml", + "evidence": "Possible path traversal in VMWare (CVE-2009-3733)" + }, + { + "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml", + "evidence": "Possible path traversal in VMWare (CVE-2009-3733)" + } + ] + } + ] +} diff --git a/results/auth.lan.ddnsgeek.com/scans/_cve_triage.md b/results/auth.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..c5ac337 --- /dev/null +++ b/results/auth.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,10 @@ +# CVE triage sheet - auth.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2005-3299 | auth.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2009-3733 | auth.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/familytree.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/familytree.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..ceae383 --- /dev/null +++ b/results/familytree.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,93 @@ +{ + "host": "familytree.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "familytree.lan.ddnsgeek.com", + "cve": "CVE-2003-1418", + "affected_host": "familytree.lan.ddnsgeek.com", + "endpoint": "unknown", + "product_version_evidence": [ + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "tcpwrapped syn-ack ttl 56" + ], + "exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 1 + } + ] + }, + { + "host": "familytree.lan.ddnsgeek.com", + "cve": "CVE-2005-3299", + "affected_host": "familytree.lan.ddnsgeek.com", + "endpoint": "443/tcp", + "product_version_evidence": [ + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)" + ], + "exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| IDs: CVE:CVE-2005-3299" + }, + { + "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299" + } + ] + }, + { + "host": "familytree.lan.ddnsgeek.com", + "cve": "CVE-2009-3733", + "affected_host": "familytree.lan.ddnsgeek.com", + "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml", + "evidence": "Possible path traversal in VMWare (CVE-2009-3733)" + }, + { + "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "|_ /sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml: Possible path traversal in VMWare (CVE-2009-3733)" + } + ] + } + ] +} diff --git a/results/familytree.lan.ddnsgeek.com/scans/_cve_triage.md b/results/familytree.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..5dee987 --- /dev/null +++ b/results/familytree.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,12 @@ +# CVE triage sheet - familytree.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2003-1418 | familytree.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2005-3299 | familytree.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2009-3733 | familytree.lan.ddnsgeek.com | `/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/kuma.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/kuma.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..a69c10a --- /dev/null +++ b/results/kuma.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,30 @@ +{ + "host": "kuma.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "kuma.lan.ddnsgeek.com", + "cve": "CVE-2017-9798", + "affected_host": "kuma.lan.ddnsgeek.com", + "endpoint": "unknown", + "product_version_evidence": [ + "http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)" + ], + "exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/kuma.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 31 + } + ] + } + ] +} diff --git a/results/kuma.lan.ddnsgeek.com/scans/_cve_triage.md b/results/kuma.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..313ddbb --- /dev/null +++ b/results/kuma.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,8 @@ +# CVE triage sheet - kuma.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2017-9798 | kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..c3f94c2 --- /dev/null +++ b/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,32 @@ +{ + "host": "monitor-kuma.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "monitor-kuma.lan.ddnsgeek.com", + "cve": "CVE-2017-9798", + "affected_host": "monitor-kuma.lan.ddnsgeek.com", + "endpoint": "unknown", + "product_version_evidence": [ + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "tcpwrapped syn-ack ttl 56" + ], + "exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/monitor-kuma.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 31 + } + ] + } + ] +} diff --git a/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_triage.md b/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..425ca13 --- /dev/null +++ b/results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,8 @@ +# CVE triage sheet - monitor-kuma.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2017-9798 | monitor-kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/nextcloud.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/nextcloud.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..20107c5 --- /dev/null +++ b/results/nextcloud.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,32 @@ +{ + "host": "nextcloud.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "nextcloud.lan.ddnsgeek.com", + "cve": "CVE-2003-1418", + "affected_host": "nextcloud.lan.ddnsgeek.com", + "endpoint": "unknown", + "product_version_evidence": [ + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "tcpwrapped syn-ack ttl 56" + ], + "exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/nextcloud.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 1 + } + ] + } + ] +} diff --git a/results/nextcloud.lan.ddnsgeek.com/scans/_cve_triage.md b/results/nextcloud.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..1f0013c --- /dev/null +++ b/results/nextcloud.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,8 @@ +# CVE triage sheet - nextcloud.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2003-1418 | nextcloud.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/prometheus.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/prometheus.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..6f9b4d7 --- /dev/null +++ b/results/prometheus.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,127 @@ +{ + "host": "prometheus.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "prometheus.lan.ddnsgeek.com", + "cve": "CVE-2009-3733", + "affected_host": "prometheus.lan.ddnsgeek.com", + "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.", + "reproducibility": "not-reproduced", + "disposition": "not-applicable", + "disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml", + "evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)" + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml", + "evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)" + } + ] + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "cve": "CVE-2011-0966", + "affected_host": "prometheus.lan.ddnsgeek.com", + "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.", + "reproducibility": "not-reproduced", + "disposition": "not-applicable", + "disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 4 + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini", + "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)" + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties", + "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)" + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.properties", + "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)" + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\log\\dbpwdChange.log", + "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)" + } + ] + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "cve": "CVE-2018-10822", + "affected_host": "prometheus.lan.ddnsgeek.com", + "endpoint": "/uir//etc/passwd", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must be affected D-Link router firmware exposing /uir/ traversal path.", + "reproducibility": "not-reproduced", + "disposition": "not-applicable", + "disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 1 + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/uir//etc/passwd", + "evidence": "Possible D-Link router directory traversal vulnerability (CVE-2018-10822) (401 Unauthorized)" + } + ] + }, + { + "host": "prometheus.lan.ddnsgeek.com", + "cve": "CVE-2018-10824", + "affected_host": "prometheus.lan.ddnsgeek.com", + "endpoint": "/uir//tmp/csman/0", + "product_version_evidence": [ + "No explicit product/version fingerprint in nmap service line." + ], + "exploit_precondition": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.", + "reproducibility": "not-reproduced", + "disposition": "not-applicable", + "disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 1 + }, + { + "file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "/uir//tmp/csman/0", + "evidence": "Possible D-Link router plaintext password file exposure (CVE-2018-10824) (401 Unauthorized)" + } + ] + } + ] +} diff --git a/results/prometheus.lan.ddnsgeek.com/scans/_cve_triage.md b/results/prometheus.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..d99ccec --- /dev/null +++ b/results/prometheus.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,14 @@ +# CVE triage sheet - prometheus.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2009-3733 | prometheus.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **not-applicable** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2011-0966 | prometheus.lan.ddnsgeek.com | `/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program%20Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.properties` | No explicit product/version fingerprint in nmap service line. | Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling. | not-reproduced | **not-applicable** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2018-10822 | prometheus.lan.ddnsgeek.com | `/uir//etc/passwd` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing /uir/ traversal path. | not-reproduced | **not-applicable** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | +| CVE-2018-10824 | prometheus.lan.ddnsgeek.com | `/uir//tmp/csman/0` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman. | not-reproduced | **not-applicable** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/shifts.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/shifts.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..1131867 --- /dev/null +++ b/results/shifts.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,38 @@ +{ + "host": "shifts.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "shifts.lan.ddnsgeek.com", + "cve": "CVE-2011-3192", + "affected_host": "shifts.lan.ddnsgeek.com", + "endpoint": "443/tcp", + "product_version_evidence": [ + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)", + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)" + ], + "exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/shifts.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| IDs: CVE:CVE-2011-3192 BID:49303" + }, + { + "file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192" + } + ] + } + ] +} diff --git a/results/shifts.lan.ddnsgeek.com/scans/_cve_triage.md b/results/shifts.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..498297c --- /dev/null +++ b/results/shifts.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,8 @@ +# CVE triage sheet - shifts.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2011-3192 | shifts.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. | diff --git a/results/stockfill.lan.ddnsgeek.com/scans/_cve_disposition.json b/results/stockfill.lan.ddnsgeek.com/scans/_cve_disposition.json new file mode 100644 index 0000000..e27f5cf --- /dev/null +++ b/results/stockfill.lan.ddnsgeek.com/scans/_cve_disposition.json @@ -0,0 +1,37 @@ +{ + "host": "stockfill.lan.ddnsgeek.com", + "generated_at": "2026-04-07T03:49:38.723646+00:00", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "findings": [ + { + "host": "stockfill.lan.ddnsgeek.com", + "cve": "CVE-2011-3192", + "affected_host": "stockfill.lan.ddnsgeek.com", + "endpoint": "443/tcp", + "product_version_evidence": [ + "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)" + ], + "exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.", + "reproducibility": "not-reproduced", + "disposition": "needs-manual-test", + "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.", + "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.", + "evidence_sources": [ + { + "file": "results/stockfill.lan.ddnsgeek.com/scans/_patterns.log", + "match_count": 2 + }, + { + "file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| IDs: BID:49303 CVE:CVE-2011-3192" + }, + { + "file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt", + "endpoint": "443/tcp", + "evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192" + } + ] + } + ] +} diff --git a/results/stockfill.lan.ddnsgeek.com/scans/_cve_triage.md b/results/stockfill.lan.ddnsgeek.com/scans/_cve_triage.md new file mode 100644 index 0000000..3631108 --- /dev/null +++ b/results/stockfill.lan.ddnsgeek.com/scans/_cve_triage.md @@ -0,0 +1,8 @@ +# CVE triage sheet - stockfill.lan.ddnsgeek.com + +Generated (UTC): 2026-04-07T03:49:38.723646+00:00 + +| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition | +|---|---|---|---|---|---|---| +| CVE-2011-3192 | stockfill.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** | +| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |