nuclei-templates/exposures/configs/magento-config-disclosure.yaml

52 lines
1.4 KiB
YAML
Raw Normal View History

2022-08-28 09:30:17 +00:00
id: magento-config-disclosure
info:
name: Magento Configuration Panel - Detect
2022-08-28 09:30:17 +00:00
author: ptonewreckin,danigoland,geeknik
severity: high
description: |
Magento configuration panel was detected. Misconfigured instances of Magento may disclose usernames, passwords, and database configurations via /app/etc/local.xml.
reference:
- https://github.com/ptonewreckin/cmsDetector/blob/master/signatures/magento.py
metadata:
verified: true
2022-08-28 09:30:17 +00:00
shodan-query: http.component:"Magento"
tags: magento,exposure,credential,config
requests:
- method: GET
path:
- "{{BaseURL}}/app/etc/local.xml"
- "{{BaseURL}}/app/etc/local.xml.additional"
- "{{BaseURL}}/store/app/etc/local.xml"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "* Magento"
- "<dbname>"
condition: and
- type: word
part: header
words:
- "application/xml"
- type: status
status:
- 200
extractors:
- type: xpath
part: body
xpath:
- "/config/global/resources/default_setup/connection/host"
- "/config/global/resources/default_setup/connection/username"
- "/config/global/resources/default_setup/connection/password"
- "/config/global/resources/default_setup/connection/dbname"
# Enhanced by md on 2023/02/22