nuclei-templates/exposures/apis/drupal-jsonapi-user-listing.yaml

id: drupal-jsonapi-user-listing

info:
  name: Drupal JSON:API User Listing
  author: lixts
  severity: medium
  reference:
    - https://www.drupal.org/project/drupal/issues/3240913
  metadata:
    verified: true
  tags: drupal,exposure

requests:
  - method: GET
    path:
      - "{{BaseURL}}/jsonapi/user/user"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"display_name":"([A-Sa-z0-9-_]+)"\}'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '\{"display_name":"([A-Za-z0-9-_]+)"\}'