converted dtale cve-2025-0655 detector to templated

[robert-doyensec]

testbed changes at doyensec/security-testbeds#42

{
  "scanStatus": "SUCCEEDED",
  "scanFindings": [{
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkService": {
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    },
    "vulnerability": {
      "mainId": {
        "publisher": "GOOGLE",
        "value": "CVE_2025_0655"
      },
      "relatedId": [{
        "publisher": "CVE",
        "value": "CVE-2025-0655"
      }],
      "severity": "CRITICAL",
      "title": "D-Tale Remote Code Execution (CVE-2025-0655)",
      "description": "D-Tale is vulnerable to a Remote Code Execution vulnerability, which was fixed in version 3.16.1, due to Global State Override mechanism. Specifically, this vulnerability leverages the ability to manipulate global  application settings to activate the enable_custom_filters feature, typically restricted to trusted environments. Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.",
      "recommendation": "You can upgrade your D-Tale instances to 3.16.1 or later."
    }
  }],
  "scanStartTimestamp": "2026-06-18T11:44:55.598Z",
  "scanDuration": "4.307s",
  "fullDetectionReports": {
    "detectionReports": [{
      "targetInfo": {
        "networkEndpoints": [{
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        }]
      },
      "networkService": {
        "networkEndpoint": {
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        },
        "transportProtocol": "TCP",
        "serviceName": "http",
        "serviceContext": {
          "webServiceContext": {
          }
        }
      },
      "detectionTimestamp": "2026-06-18T11:44:59.877Z",
      "detectionStatus": "VULNERABILITY_VERIFIED",
      "vulnerability": {
        "mainId": {
          "publisher": "GOOGLE",
          "value": "CVE_2025_0655"
        },
        "relatedId": [{
          "publisher": "CVE",
          "value": "CVE-2025-0655"
        }],
        "severity": "CRITICAL",
        "title": "D-Tale Remote Code Execution (CVE-2025-0655)",
        "description": "D-Tale is vulnerable to a Remote Code Execution vulnerability, which was fixed in version 3.16.1, due to Global State Override mechanism. Specifically, this vulnerability leverages the ability to manipulate global  application settings to activate the enable_custom_filters feature, typically restricted to trusted environments. Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.",
        "recommendation": "You can upgrade your D-Tale instances to 3.16.1 or later."
      }
    }]
  },
  "reconnaissanceReport": {
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkServices": [{
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    }]
  },
  "targetAlive": true
}

[giacomo-doyensec]

LGTM - just a couple of typos

[giacomo-doyensec]

Suggested change

	" global application settings to activate the enable_custom_filters"
	" global application settings to activate the enable_custom_filters"

[giacomo-doyensec]

Suggested change

	uri: "/dtale/update-settings/112233?settings=%7B%22enable_custom_filters%22%3Atrue%7D",
	uri: "/dtale/update-settings/112233?settings=%7B%22enable_custom_filters%22%3Atrue%7D"