nuclei-templates/http/exposures/configs/docker-compose-config.yaml

id: docker-compose-config

info:
  name: Docker Compose - Detect
  author: meme-lord,blckraven,geeknik
  severity: medium
  description: Multiple Docker Compose configuration files were detected. The configuration allows deploy, combine and configure operations on multiple containers at the same time. The default is to outsource each process to its own container, which is then publicly accessible.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    max-request: 7
  tags: config,exposure,devops

http:
  - method: GET
    host-redirects: true
    max-redirects: 3
    path:
      - "{{BaseURL}}/docker-compose.yml"
      - "{{BaseURL}}/docker-compose.prod.yml"
      - "{{BaseURL}}/docker-compose.production.yml"
      - "{{BaseURL}}/docker-compose.staging.yml"
      - "{{BaseURL}}/docker-compose.dev.yml"
      - "{{BaseURL}}/docker-compose-dev.yml"
      - "{{BaseURL}}/docker-compose.override.yml"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'regex("^version: ", body) && contains(body, "services:")'

      - type: status
        status:
          - 200

# digest: 480a00453043021f333b19a7793274be32b58a1587b410273667fa68dd13ec5d5df24b6bd8670402201773c6cde0f65ede2be52071a856644ac16db29ca65fa44f29bdd5c1edaff11e:922c64590222798bb761d5b6d8e72950
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00			`id: docker-compose-config`

			`info:`
Enhancement: exposures/configs/docker-compose-config.yaml by md 2023-02-09 21:38:53 +00:00			`name: Docker Compose - Detect`
Updated author names 2021-06-09 12:20:56 +00:00			`author: meme-lord,blckraven,geeknik`
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00			`severity: medium`
Enhancement: exposures/configs/docker-compose-config.yaml by md 2023-02-09 21:38:53 +00:00			`description: Multiple Docker Compose configuration files were detected. The configuration allows deploy, combine and configure operations on multiple containers at the same time. The default is to outsource each process to its own container, which is then publicly accessible.`
Enhancement: exposures/configs/docker-compose-config.yaml by md 2023-02-09 19:34:04 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
			`cvss-score: 5.3`
			`cwe-id: CWE-200`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 7`
templateman update 2023-10-14 11:27:55 +00:00			`tags: config,exposure,devops`
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00			`- method: GET`
Using "host-redirects" instead of "redirects" to avoid scanning 3rd party / out of scope hosts. (#5491) 2022-10-07 21:27:25 +00:00			`host-redirects: true`
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00			`max-redirects: 3`
			`path:`
			`- "{{BaseURL}}/docker-compose.yml"`
Update docker-compose-config.yml (#839) 2021-02-11 07:37:02 +00:00			`- "{{BaseURL}}/docker-compose.prod.yml"`
			`- "{{BaseURL}}/docker-compose.production.yml"`
			`- "{{BaseURL}}/docker-compose.staging.yml"`
			`- "{{BaseURL}}/docker-compose.dev.yml"`
Update docker-compose-config.yml My bad, wasn't a duplicate line. Guess I need my eyes checked. \m/ 2021-03-09 20:52:45 +00:00			`- "{{BaseURL}}/docker-compose-dev.yml"`
Update docker-compose-config.yml Remove duplicate line and add support for docker-compose.override.yml 2021-03-09 20:49:46 +00:00			`- "{{BaseURL}}/docker-compose.override.yml"`

Added stop-at-first-match in applicable templates 2021-09-02 11:59:10 +00:00			`stop-at-first-match: true`
templateman update 2023-10-14 11:27:55 +00:00
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: dsl`
			`dsl:`
removing redundant boolean check 2021-03-24 23:28:50 +00:00			`- 'regex("^version: ", body) && contains(body, "services:")'`
Add template for docker-compose config disclosure (#837) 2021-02-10 20:15:57 +00:00
			`- type: status`
			`status:`
			`- 200`
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot: 2023-10-20 11:41:13 +00:00
			`# digest: 480a00453043021f333b19a7793274be32b58a1587b410273667fa68dd13ec5d5df24b6bd8670402201773c6cde0f65ede2be52071a856644ac16db29ca65fa44f29bdd5c1edaff11e:922c64590222798bb761d5b6d8e72950`