diff --git a/SYNTAX-REFERENCE.md b/SYNTAX-REFERENCE.md index 9df9152c4..1afaa7887 100755 --- a/SYNTAX-REFERENCE.md +++ b/SYNTAX-REFERENCE.md @@ -492,6 +492,35 @@ description: Subversion ALM for the enterprise before 8.8.2 allows reflected XSS ``` + + +
+ +
+ +impact string + +
+
+ +Impact of the template. + +You can go in-depth here on impact of the template. + + + +Examples: + + +```yaml +impact: Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. +``` + +```yaml +impact: Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. +``` + +
diff --git a/nuclei-jsonschema.json b/nuclei-jsonschema.json index ff8291eb1..723f06f88 100644 --- a/nuclei-jsonschema.json +++ b/nuclei-jsonschema.json @@ -78,6 +78,14 @@ "Bower is a package manager which stores package information in the bower.json file" ] }, + "impact": { + "type": "string", + "title": "impact of the template", + "description": "In-depth explanation on the impact of the issue found by the template", + "examples": [ + "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries" + ] + }, "reference": { "$schema": "http://json-schema.org/draft-04/schema#", "$ref": "#/definitions/stringslice.RawStringSlice", diff --git a/v2/pkg/templates/templates_doc.go b/v2/pkg/templates/templates_doc.go index fb490ffb5..e093fe88c 100644 --- a/v2/pkg/templates/templates_doc.go +++ b/v2/pkg/templates/templates_doc.go @@ -155,7 +155,7 @@ func init() { FieldName: "info", }, } - MODELInfoDoc.Fields = make([]encoder.Doc, 9) + MODELInfoDoc.Fields = make([]encoder.Doc, 10) MODELInfoDoc.Fields[0].Name = "name" MODELInfoDoc.Fields[0].Type = "string" MODELInfoDoc.Fields[0].Note = "" @@ -188,37 +188,46 @@ func init() { MODELInfoDoc.Fields[3].AddExample("", "Bower is a package manager which stores package information in the bower.json file") MODELInfoDoc.Fields[3].AddExample("", "Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations") - MODELInfoDoc.Fields[4].Name = "reference" - MODELInfoDoc.Fields[4].Type = "stringslice.RawStringSlice" + MODELInfoDoc.Fields[4].Name = "impact" + MODELInfoDoc.Fields[4].Type = "string" MODELInfoDoc.Fields[4].Note = "" - MODELInfoDoc.Fields[4].Description = "References for the template.\n\nThis should contain links relevant to the template." - MODELInfoDoc.Fields[4].Comments[encoder.LineComment] = "References for the template." + MODELInfoDoc.Fields[4].Description = "Impact of the template.\n\nYou can go in-depth here on impact of the template." + MODELInfoDoc.Fields[4].Comments[encoder.LineComment] = "Impact of the template." - MODELInfoDoc.Fields[4].AddExample("", []string{"https://github.com/strapi/strapi", "https://github.com/getgrav/grav"}) - MODELInfoDoc.Fields[5].Name = "severity" - MODELInfoDoc.Fields[5].Type = "severity.Holder" + MODELInfoDoc.Fields[4].AddExample("", "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.") + + MODELInfoDoc.Fields[4].AddExample("", "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.") + MODELInfoDoc.Fields[5].Name = "reference" + MODELInfoDoc.Fields[5].Type = "stringslice.RawStringSlice" MODELInfoDoc.Fields[5].Note = "" - MODELInfoDoc.Fields[5].Description = "Severity of the template." - MODELInfoDoc.Fields[5].Comments[encoder.LineComment] = "Severity of the template." - MODELInfoDoc.Fields[6].Name = "metadata" - MODELInfoDoc.Fields[6].Type = "map[string]interface{}" + MODELInfoDoc.Fields[5].Description = "References for the template.\n\nThis should contain links relevant to the template." + MODELInfoDoc.Fields[5].Comments[encoder.LineComment] = "References for the template." + + MODELInfoDoc.Fields[5].AddExample("", []string{"https://github.com/strapi/strapi", "https://github.com/getgrav/grav"}) + MODELInfoDoc.Fields[6].Name = "severity" + MODELInfoDoc.Fields[6].Type = "severity.Holder" MODELInfoDoc.Fields[6].Note = "" - MODELInfoDoc.Fields[6].Description = "Metadata of the template." - MODELInfoDoc.Fields[6].Comments[encoder.LineComment] = "Metadata of the template." - - MODELInfoDoc.Fields[6].AddExample("", map[string]string{"customField1": "customValue1"}) - MODELInfoDoc.Fields[7].Name = "classification" - MODELInfoDoc.Fields[7].Type = "model.Classification" + MODELInfoDoc.Fields[6].Description = "Severity of the template." + MODELInfoDoc.Fields[6].Comments[encoder.LineComment] = "Severity of the template." + MODELInfoDoc.Fields[7].Name = "metadata" + MODELInfoDoc.Fields[7].Type = "map[string]interface{}" MODELInfoDoc.Fields[7].Note = "" - MODELInfoDoc.Fields[7].Description = "Classification contains classification information about the template." - MODELInfoDoc.Fields[7].Comments[encoder.LineComment] = "Classification contains classification information about the template." - MODELInfoDoc.Fields[8].Name = "remediation" - MODELInfoDoc.Fields[8].Type = "string" - MODELInfoDoc.Fields[8].Note = "" - MODELInfoDoc.Fields[8].Description = "Remediation steps for the template.\n\nYou can go in-depth here on how to mitigate the problem found by this template." - MODELInfoDoc.Fields[8].Comments[encoder.LineComment] = "Remediation steps for the template." + MODELInfoDoc.Fields[7].Description = "Metadata of the template." + MODELInfoDoc.Fields[7].Comments[encoder.LineComment] = "Metadata of the template." - MODELInfoDoc.Fields[8].AddExample("", "Change the default administrative username and password of Apache ActiveMQ by editing the file jetty-realm.properties") + MODELInfoDoc.Fields[7].AddExample("", map[string]string{"customField1": "customValue1"}) + MODELInfoDoc.Fields[8].Name = "classification" + MODELInfoDoc.Fields[8].Type = "model.Classification" + MODELInfoDoc.Fields[8].Note = "" + MODELInfoDoc.Fields[8].Description = "Classification contains classification information about the template." + MODELInfoDoc.Fields[8].Comments[encoder.LineComment] = "Classification contains classification information about the template." + MODELInfoDoc.Fields[9].Name = "remediation" + MODELInfoDoc.Fields[9].Type = "string" + MODELInfoDoc.Fields[9].Note = "" + MODELInfoDoc.Fields[9].Description = "Remediation steps for the template.\n\nYou can go in-depth here on how to mitigate the problem found by this template." + MODELInfoDoc.Fields[9].Comments[encoder.LineComment] = "Remediation steps for the template." + + MODELInfoDoc.Fields[9].AddExample("", "Change the default administrative username and password of Apache ActiveMQ by editing the file jetty-realm.properties") STRINGSLICEStringSliceDoc.Type = "stringslice.StringSlice" STRINGSLICEStringSliceDoc.Comments[encoder.LineComment] = " StringSlice represents a single (in-lined) or multiple string value(s)."