add env goanywhere_mft CVE-2023-0669

[SuperX-SIR]

No description provided.

[giacomo-doyensec]

Hello @SuperX-SIR thanks for your contribution!
Reproduction steps appears to be missing from the testbed, can you provide them? A list of curl commands would be ideal.

[SuperX-SIR]

appears to be missing

Simply download the listed Docker images and run them as instructed.

Vulnerable image
kutzhanov/goanywhere:6.8.6

safe iamge
helpsystems/goanywhere-mft:7.1.3

run the container
docker run --publish 38000:8000 --publish 38001:8001 --publish 38005:8005 --publish 38006:8006 --publish 38009:8009 --publish 38010:8010 --publish 38443:8443 --publish 38021:8021 --publish 38022:8022 --publish 32001-32300:32001-32300 --publish 34434:4434 --publish 34121:2121 --publish 39909:9909 --publish 34222:2222  --publish 36330:6330 --publish 35005:5005  --name my_mft_6_8_6 kutzhanov/goanywhere:6.8.6

[giacomo-doyensec]

Hello @SuperX-SIR, I am referring to the command injection vulnerability reproduction steps.

[SuperX-SIR]

submit in
google/tsunami-security-scanner-plugins#541

[giacomo-doyensec]

It would be better if you could provide a PoC under the form of easy to reproduce steps in the testbed's README.md file. You can refer to this if in doubt.