Better Spring4Shell detection logic#593

Closed

lokiuox wants to merge 143 commits intogoogle:masterfrom

doyensec:spring4shell_detection

Commits on Mar 7, 2023

Commits on Mar 8, 2023

Move liblua to a static list and reformat code
shpei1963
committed
Merge branch 'master' of https://github.com/shpei1963/tsunami-security-scanner-plugins
shpei1963
committed

Commits on Apr 19, 2023

v0.1
am0o0
committed

Commits on Apr 29, 2024

Added CVE-2023-26360 Adobe ColdFusion
jimmy-ly00
committed

Commits on Jun 6, 2024

slurm exposed rest api detector: first commit
lanced00m
committed

Commits on Jun 13, 2024

Initiating the integration of the Argo CD weak credential tester plugin.
JamesFoxxx
committed

Commits on Sep 11, 2024

Add CVE-2024-2928 Detector
frkngksl
committed

Commits on Sep 30, 2024

Update Cve20242928VulnDetector.java
frkngksl
authored

Commits on Oct 16, 2024

Commits on Nov 5, 2024

remove "nodes" field as this is not mandatory and it can cause errors sometimes.
lanced00m
authored

Commits on Nov 27, 2024

Commits on Nov 28, 2024

perform issues of second review
lanced00m
committed

Commits on Nov 29, 2024

Commits on Nov 30, 2024

url encode the payload
am0o0
committed

Commits on Dec 6, 2024

Update community/detectors/adobe_coldfusion_cve_2023_26360/src/main/java/com/google/tsunami/plugins/detectors/cves/cve202326360/Cve202326360Detector.java

jimmy-ly00
and
giacomo-doyensec
authored

Commits on Dec 9, 2024

Commits on Dec 10, 2024

remove withcallback method, simplified control flow, unnecessary http headers, unnecessary parameters in http request, fix README.md
am0o0
committed

Commits on Dec 11, 2024

merge two methods
am0o0
committed

Commits on Dec 12, 2024

add sleepUninterruptibly
am0o0
committed

Commits on Dec 13, 2024

some formatting issues
am0o0
committed

Commits on Dec 15, 2024

Add YAML and BIN files for LocalAI RCE
frkngksl
committed

Commits on Feb 6, 2025

Enforce Scope Check in Fingerprinters
lokiuox
committed

Commits on Feb 10, 2025

Commits on Feb 12, 2025

Commits on Feb 13, 2025

Commits on Feb 14, 2025

Commits on Feb 17, 2025

Commits on Feb 19, 2025

Commits on Feb 20, 2025

Fix the imports and reformat the spark fingerprinting example.

tooryx
authored and
copybara-github
committed

Commits on Feb 25, 2025

Disable debugging and reformat the `cleanup_actions` for readability on the `MLFlow_CVE_2023_6977` detector.

tooryx
authored and
copybara-github
committed

Commits on Feb 28, 2025

remove graddle wrappers for cve20236018 as it will be converted to the templated format
tooryx
committed
Create templated plugin implementation of CVE-2023-6018 and remove java version of it.

Marius Steffens
authored and
copybara-github
committed

Commits on Mar 5, 2025

Introduce an exposed UI detector for ComfyUI. Written by Doyensec.

tooryx
authored and
copybara-github
committed
add gradle wrappers for ComfyUI exposed interface
tooryx
committed
Upgrade `actions/cache` to `v4` in Github workflows.

tooryx
authored and
copybara-github
committed

Commits on Mar 14, 2025

Normalize existing templated detectors with a leading `/` in the `uri` field.

tooryx
authored and
copybara-github
committed

Commits on Mar 18, 2025

Fix a typo in a few tests as `TSUNAMI_ANY_URI` does not exist.

tooryx
authored and
copybara-github
committed
Fix most templated plugins as the `severity` field was missing.

tooryx
authored and
copybara-github
committed

Commits on Mar 19, 2025

Rework unit tests for templated plugins.

tooryx
authored and
copybara-github
committed

Commits on Apr 8, 2025

add wrappers for the templated plugins
tooryx
committed

Commits on Apr 9, 2025

Add a recommendation for the ExposedArgoWorkflow detector.

tooryx
authored and
copybara-github
committed

Commits on Apr 15, 2025

Commits on Apr 16, 2025

Commits on May 14, 2025

Fix the switch case in the utility action runner for external builds.

tooryx
authored and
copybara-github
committed

Commits on May 16, 2025

Commits on May 22, 2025

Commits on May 23, 2025

Remove the `CVE-2024-6387` (regreSSHion) plugin completely as the relevance of its finding is not good enough for Tsunami.

tooryx
authored and
copybara-github
committed

Commits on May 28, 2025

Commits on Jun 3, 2025

Add a `go.mod` to Tsunami plugins so that we can use it in Golang tooling.

tooryx
authored and
copybara-github
committed

Commits on Jun 4, 2025

Update the proto definition to support Golang generation.

tooryx
authored and
copybara-github
committed
Manually generate the golang code for the templated plugin proto definitions.

tooryx
authored and
copybara-github
committed

Commits on Jun 5, 2025

Add a linter for the templated language plugins.

tooryx
authored and
copybara-github
committed
Add automation to verify templated plugins on push.

tooryx
authored and
copybara-github
committed

Commits on Jun 13, 2025

Commits on Jun 16, 2025

Ensure that `getAdvisories()` does not trigger a null pointer exception when dealing with protos.

tooryx
authored and
copybara-github
committed
Add the related CVE for detector `Cve202224112Detector`.

tooryx
authored and
copybara-github
committed

Commits on Jun 17, 2025

Initial PoC

lokiuox
authored and
savio-doyensec
committed
Shorter delays

lokiuox
authored and
savio-doyensec
committed
Optimized exploit

lokiuox
authored and
savio-doyensec
committed
Redirect logs to /dev/null

lokiuox
authored and
savio-doyensec
committed
Fixed warnings

lokiuox
authored and
savio-doyensec
committed
Fixed tests

lokiuox
authored and
savio-doyensec
committed
Fix style

lokiuox
authored and
savio-doyensec
committed
Use generateNoCallback

lokiuox
authored and
savio-doyensec
committed
Merge branch 'spring4shell_detection' of github.com:doyensec/tsunami-security-scanner-plugins into spring4shell_detection
savio-doyensec
committed