Update CVE-2011-3192-Apache DoS.bcheck

added a new header Content-Range; improved rules for detection to compare in a case-insensitive way.
PortSwigger · Aug 13, 2024 · 8c1b651 · 8c1b651
1 parent b918ebb
commit 8c1b651
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/vulnerabilities-CVEd/CVE-2011-3192-Apache DoS.bcheck b/vulnerabilities-CVEd/CVE-2011-3192-Apache DoS.bcheck
@@ -11,7 +11,7 @@ metadata:
     define:
         DoS_payload = "bytes=0-,0-"
     #    DoS_payload = "bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-"
-        response_payload = "Content-range: bytes"
+        response_payload = "content-range: bytes"
 
 given path then
     send request called check:
@@ -22,9 +22,10 @@ given path then
             method: "GET"
                 headers: "Range": {DoS_payload}
                 headers: "Request-Range": {DoS_payload}
+                headers: "Content-Range": {DoS_payload}
 
         if {DoS.response.status_code} is "206" and
-            ({response_payload} in {DoS.response.body}) then
+            ({response_payload} in {to_lower(DoS.response.body)}) then
             report issue:
                 severity: high
                 confidence: firm