Hi @hh-hunter,

Thanks for your request! This vulnerability is in scope for the reward program. Please submit our participation form and you can start working on the development.

Please keep in mind that the Tsunami Scanner Team will only be able to work at one issue at a time for each participant so please hold on the implementation work for any other requests you might have.

Thanks!

@tooryx Hi, I noticed that the log4j detection logic I submitted earlier is no longer in the code. What is it caused by?

@tooryx Does the relevant class exist now that can implement this operation of deploying an XML file remotely to exploit this vulnerability?If not, I am prepared to write a direct version detection logic instead of executing vulnerable commands.

Hi @hh-hunter,

I have labeled your other issues as "Contributor queue" for now. We are enforcing more strictly the one review per contributor as we cannot keep up with review otherwise. We will review this plugin and then dequeue the other ones progressively.

If you think I incorrectly labeled one of the issues, please let me know.
~tooryx

Okay.I have accumulated a lot of plugins, please review them as soon as possible. In addition, regarding the vulnerability in the password recovery email of GitLab, I believe using the built-in oob domain name in Tsunami is a perfect solution, under the current version of Tsunami plugin. If contributors within the community are unable to complete vulnerability requests, they should be handed over to other contributors to complete.