cve-2022-40684.sh

description = [[
Detecta Fortinet con FortiOS 7.x potencialmente vulnerable a saltar autenticacion CVE-2022-40684
puertos TCP habituales Fortinet: 80,10443,5411,443,4433,8443,4443,444,9443,7443,1723,6443,8009,10000,55443,9000,8081,8880,8889,9001
]]
local http = require "http"
local shortport = require "shortport"
local vulns = require "vulns"
local stdnse = require "stdnse"
local string = require "string"
----
-- @hackyseguridad
-- nmap -p <port> --script cve-40684-2022.nse <target>
---
author = "hackingyseguridad.com"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "vuln" }

portrule = shortport.http

  action = function(host, port)
  local vuln = {
    title = "Detecta Fortinet con FortiOS 7.x vuln, CVE-2022-40684",
    state = vulns.STATE.NOT_VULN,
    description = [[
    ]],
    IDS = {
        CVE = "CVE-2022-40684"
    },
    references = {
        'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684',
    },
    dates = {
        disclosure = { year = '2022', month = '09', day = '14' }
    }
  }
 options = {header={}}    options['header']['User-Agent'] = "Node.js"
 local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
 local url = stdnse.get_script_args(SCRIPT_NAME..".url") or "/api/v2/cmdb/system/admin"
 local response = http.generic_request(host, port, "GET", "/api/v2/cmdb/system/admin", options)

 if response.status == 401 then
 vuln.state = vulns.STATE.VULN
 end
 return vuln_report:make_output(vuln)
end
---- www.hackingyseguridad.coom ----