Add CVE triage and disposition artifacts for scan hits

2026-04-13 10:38:15 +10:00
parent 7817122265
commit 60c1719b6d
18 changed files with 818 additions and 0 deletions
@@ -0,0 +1,67 @@
+{
+  "host": "auth.lan.ddnsgeek.com",
+  "generated_at": "2026-04-07T03:49:38.723646+00:00",
+  "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
+  "findings": [
+    {
+      "host": "auth.lan.ddnsgeek.com",
+      "cve": "CVE-2005-3299",
+      "affected_host": "auth.lan.ddnsgeek.com",
+      "endpoint": "443/tcp",
+      "product_version_evidence": [
+        "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
+      ],
+      "exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
+      "reproducibility": "not-reproduced",
+      "disposition": "needs-manual-test",
+      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
+      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
+      "evidence_sources": [
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
+          "match_count": 2
+        },
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
+          "endpoint": "443/tcp",
+          "evidence": "|     IDs:  CVE:CVE-2005-3299"
+        },
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
+          "endpoint": "443/tcp",
+          "evidence": "|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
+        }
+      ]
+    },
+    {
+      "host": "auth.lan.ddnsgeek.com",
+      "cve": "CVE-2009-3733",
+      "affected_host": "auth.lan.ddnsgeek.com",
+      "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
+      "product_version_evidence": [
+        "No explicit product/version fingerprint in nmap service line."
+      ],
+      "exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
+      "reproducibility": "not-reproduced",
+      "disposition": "needs-manual-test",
+      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
+      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
+      "evidence_sources": [
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
+          "match_count": 2
+        },
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
+          "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
+          "evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
+        },
+        {
+          "file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
+          "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
+          "evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,10 @@
+# CVE triage sheet - auth.lan.ddnsgeek.com
+
+Generated (UTC): 2026-04-07T03:49:38.723646+00:00
+
+| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
+|---|---|---|---|---|---|---|
+| CVE-2005-3299 | auth.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** |
+|  |  |  |  |  |  | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
+| CVE-2009-3733 | auth.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** |
+|  |  |  |  |  |  | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |