Added httpbin-contenttype-xss.yaml

[AyushXtha]

Template / PR Information

The vulnerability is Reflected XSS in go-httpbin due to unrestricted client control over Content-Type. The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.

• References: GHSA-528q-4pgm-wvg2

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

shodan-query:
  - html:"https://github.com/mccutchen/go-httpbin"
  - title:"httpbingo.org"

[GeorginaReeder]

Thanks for your contribution @AyushXtha ! :)

[AyushXtha]

Hello @DhiyaneshGeek @pussycat0x ,
This change "Server": [ will not cover all the test cases. For example: https://httpbin.org/response-headers?Content-Type=text/html&Server=%3Cimg/src/onerror=alert()%3E

[DhiyaneshGeek]

Hi @AyushXtha

Can you share a FN results which doesn't contain

"Server": [

Because as far i know it contained the "Server": [ keyword

Looking forward to hear back from you

Thanks

[AyushXtha]

Hello @DhiyaneshGeek ,
The FN results which doesn't contain

"Server": [

are:

https://httpbin.org/response-headers?Content-Type=text/html&Server=%3CS%3Eprojectdisocvery
https://httpbin.yurplan.com/response-headers?Content-Type=text/html&Server=%3CS%3EprojectDISCOVERy
https://httpbin-8964.expat.com/response-headers?Content-Type=text/html&Server=%3CS%3EprojectDISCOVERy

[DhiyaneshGeek]

Hi @AyushXtha

i have updated the template, let me know if this looks good

Thanks