From 9c27342524452f825b58333ca5139862b866a4c4 Mon Sep 17 00:00:00 2001 From: Kostas Milonas Date: Sun, 28 Oct 2018 19:54:38 +0200 Subject: [PATCH] Improve accuracy of script http-vuln-cve2017-1001000.nse --- scripts/http-vuln-cve2017-1001000.nse | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/scripts/http-vuln-cve2017-1001000.nse b/scripts/http-vuln-cve2017-1001000.nse index ed32580ea..a04b2fed8 100644 --- a/scripts/http-vuln-cve2017-1001000.nse +++ b/scripts/http-vuln-cve2017-1001000.nse @@ -96,6 +96,11 @@ Versions 4.7.0 and 4.7.1 are known to be affected. local status, json_data = json.parse(response.body) + --Check for empty dataset + if (json_data[1]==nil) then + return vulnReport:make_output(vuln_table) + end + --Parsing the json_data to get the ID of the first post and the date. local id=json_data[1].id local content=json_data[1].date @@ -120,6 +125,12 @@ Versions 4.7.0 and 4.7.1 are known to be affected. --of the post and it is vulnerable. if(response1.status and response1.status==200) then vuln_table.state = vulns.STATE.VULN + + --Despite the http status being 200, check if the response contains an error + local response1_json_status, response1_json_data = json.parse(response1.body) + if (response1_json_status and response1_json_data.data and response1_json_data.data.status~=200) then + vuln_table.state = vulns.STATE.NOT_VULN + end end return vulnReport:make_output(vuln_table) end