PRP: hashicorp nomad exposed UI RCE

[am0o0]

Testbed:
google/security-testbeds#158

PRP issue:
#687

[robert-doyensec]

Hi @am0o0 , just a reminder that this is waiting on the testbed ( google/security-testbeds#158 (comment) )

[robert-doyensec]

Hi @am0o0 , I'm running into trouble confirming the vulnerability with the provided detector. The curl command that you included in the README for the testbed seems to work, but the templated detector gives this error in the server (with no callback triggered):
[DEBUG] http: request failed: method=POST path=/v1/jobs error="invalid character 't' after object key:value pair" code=400
Can you confirm that the templated detector works on your end, and if not, update it? I think it's probably an escaping issue somewhere, but couldn't immediately find it.

[am0o0]

@robert-doyensec Hi
Thank you for reviewing this PR I fixed the issue by trying to remove a field value that wasn't necessary to exist, and the plugin works fine this time.

[robert-doyensec]

LGTM - Approved
@tooryx , this can be merged alongside google/security-testbeds#158

Reviewer: Robert, Doyensec
Plugin: Hashicorp Nomad Exposed UI RCE
Drawbacks: None.