nuclei-templates/http/exposures/configs/appspec-yml-disclosure.yaml

37 lines
829 B
YAML
Raw Normal View History

id: appspec-yml-disclosure
2021-07-21 05:39:04 +00:00
info:
name: Appspec YML/YAML - Detect
2021-07-21 05:39:04 +00:00
author: dhiyaneshDk
severity: medium
description: Appspec YML and YAML files are susceptible to information disclosure.
reference:
- https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/appsec-yml-disclosure.json
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
metadata:
max-request: 2
2023-10-14 11:27:55 +00:00
tags: exposure,config
2021-07-21 05:39:04 +00:00
http:
2021-07-21 05:39:04 +00:00
- method: GET
path:
- "{{BaseURL}}/appspec.yml"
- "{{BaseURL}}/appspec.yaml"
2021-07-22 11:02:37 +00:00
2021-07-21 05:39:04 +00:00
matchers-condition: and
matchers:
- type: word
words:
2021-07-22 11:02:37 +00:00
- "version:"
- "os:"
- "files:"
2021-07-21 05:39:04 +00:00
part: body
2021-07-22 11:02:37 +00:00
condition: and
2021-07-23 18:42:28 +00:00
2021-07-21 05:39:04 +00:00
- type: status
status:
- 200