nuclei-templates/file/audit/fortigate/scp-admin.yaml

id: scp-admin

info:
  name: Fortinet Admin-SCP - Detect
  author: pussycat0x
  severity: info
  description: Fortinet Admin-SCP functionality is recommended to be disabled by default. Enabling SCP allows download of the configuration file from the FortiGate as an alternative method of backing up the configuration file.
  reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
  tags: audit,config,file,firewall,fortigate

file:
  - extensions:
      - conf

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "set admin-scp enable"
        negative: true

      - type: word
        words:
          - "config system"
          - "config router"
          - "config firewall"
        condition: or

# Enhanced by md on 2023/05/04