New module for CVE 2026 27176

[Aarush289]

Proposed change

Adds a Nettacker module for detecting CVE-2026-27176 in affected targets
Fixes #1568

Tested against local server

Type of change

• New core framework functionality
• Bugfix (non-breaking change that fixes an issue)
• Code refactoring without any functionality changes
• New or existing module/payload change
• Documentation/localization improvement
• Test coverage improvement
• Dependency upgrade
• Other improvement (best practice, cleanup, optimization, etc)

Checklist

• I've followed the contributing guidelines
• I've digitally signed all my commits in this PR
• I've run make pre-commit and confirm it didn't generate any warnings/changes
• I've run make test and I confirm all tests passed locally
• I've added/updated any relevant documentation in the docs/ folder
• I've linked this PR with an open issue
• I've tested and verified that my code works as intended and resolves the issue as described
• I've attached screenshots demonstrating that my code works as intended (if applicable)
• I've checked all other open PRs to avoid submitting duplicate work
• I confirm that the code and comments in this PR are not direct unreviewed outputs of AI
• I confirm that I am the Sole Responsible Author for every line of code, comment, and design decision

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2a79233-d2fc-4ead-aa93-5c549bad1af1

📥 Commits

Reviewing files that changed from the base of the PR and between 3a27479 and 580c797.

📒 Files selected for processing (1)

• docs/Modules.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/Modules.md

---

Summary by CodeRabbit

• New Features
  • Added a new vulnerability check for a reflected cross-site scripting issue targeting Majordomo-related endpoints.
  • Updated the modules documentation to include the new vulnerability test entry.

Walkthrough

Adds a Nettacker vulnerability module for MajorDoMo reflected XSS (CVE-2026-27176). It probes command.php with a crafted qry parameter, validates the reflected payload, and registers the module in docs/Modules.md.

Changes

MajorDoMo XSS CVE-2026-27176 Module

Layer / File(s)	Summary
Vulnerability definition and module registration nettacker/modules/vuln/majordomo_xss_cve_2026_27176.yaml, docs/Modules.md	Defines the HTTP GET probe, payload, response validation rules, and vulnerability metadata, then adds the module to the Vuln Modules documentation list.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: new module

Suggested reviewers: arkid15r, securestep9

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: a new module for CVE-2026-27176.
Description check	✅ Passed	The description matches the changeset and links the new module to issue #1568.
Linked Issues check	✅ Passed	The module implements detection for the reflected XSS in command.php as requested by #1568.
Out of Scope Changes check	✅ Passed	Only the module and its docs were changed, which align with the issue scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nettacker/modules/vuln/majordomo_xss_cve_2026_27176.yaml`:
- Line 55: In the regex pattern for the reflected-XSS vulnerability check, the
parentheses in the payload string `alert(document.domain)` are being interpreted
as regex metacharacters rather than literal characters. Escape these parentheses
by adding backslashes before the opening parenthesis of `alert(` and the closing
parenthesis after `domain` so that the regex treats them as literal characters
to match in the response, ensuring the vulnerability detection does not miss
vulnerable payloads.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f1cd7362-7408-4d53-99dd-1ed274906b11

📥 Commits

Reviewing files that changed from the base of the PR and between 81328dd and f708d01.

📒 Files selected for processing (2)

• docs/Modules.md
• nettacker/modules/vuln/majordomo_xss_cve_2026_27176.yaml

[securestep9]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[securestep9]

@Aarush289 please test the module properly and validate the regex - my tests against the vulnerable server are failing(this module is not detecting the XSS which is definitely there). Please also consider working on another CVE in the same software CVE-2026-27174 (RCE)

[securestep9]

@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3a274793eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Strip the block-scalar newline from the matcher

When MajorDoMo returns the vulnerable response without a newline preceding both Command: and the reflected payload—for example, a single-line/minified page—this condition never matches. YAML's | preserves a trailing \n, so the lookaheads remain zero-width and the regex additionally requires a newline at the current match position; use |- or a quoted scalar so detection depends only on the two intended markers.

Useful? React with 👍 / 👎.