nuclei-templates/http/exposures/logs/roundcube-log-disclosure.yaml

id: roundcube-log-disclosure

info:
  name: Roundcube Log Disclosure
  author: dhiyaneshDk,kazet
  severity: medium
  description: Roundcube Log file was disclosed.
  reference:
    - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/roundcube-log-disclosure.json
  metadata:
    max-request: 16
  tags: exposure,logs

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{roundcube_path}}"

    payloads:
      roundcube_path:
        - roundcube/logs/sendmail
        - roundcube/logs/sendmail.log
        - roundcube/logs/errors.log
        - roundcube/logs/errors
        - webmail/logs/sendmail
        - webmail/logs/sendmail.log
        - webmail/logs/errors.log
        - webmail/logs/errors
        - mail/logs/sendmail
        - mail/logs/sendmail.log
        - mail/logs/errors.log
        - mail/logs/errors
        - logs/sendmail
        - logs/sendmail.log
        - logs/errors.log
        - logs/errors
    max-size: 1000

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "IMAP Error:"
          - "Message for"
          - "DB Error:"
          - "IMAP Error:"
          - "PHP Error:"
          - "PHP Warning:"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - content_length
# digest: 4b0a00483046022100f29f0edc0fd1c21ddc672864cdd1b0e8f9b6bf2fd245e63e3a18e009f87dda4802210094fc7c7162920f3d1b9a810729c4ac860b27bb6b73a4fe837009758cf4ee4fae:922c64590222798bb761d5b6d8e72950
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00			`id: roundcube-log-disclosure`

			`info:`
			`name: Roundcube Log Disclosure`
misc fixes / update 2023-06-20 10:23:31 +00:00			`author: dhiyaneshDk,kazet`
More effective Roundcube log disclosure template. 2023-06-08 15:12:16 +00:00			`severity: medium`
Description Added 2023-12-22 10:04:09 +00:00			`description: Roundcube Log file was disclosed.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/roundcube-log-disclosure.json`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
TemplateMan Update [Mon Mar 4 08:20:22 UTC 2024] :robot: 2024-03-04 08:20:22 +00:00			`max-request: 16`
templateman update 2023-10-14 11:27:55 +00:00			`tags: exposure,logs`
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00			`- method: GET`
			`path:`
misc fixes / update 2023-06-20 10:23:31 +00:00			`- "{{BaseURL}}/{{roundcube_path}}"`
Update exposures/logs/roundcube-log-disclosure.yaml Co-authored-by: Toufik Airane <toufik.airane@appsectribe.com> 2021-07-23 04:17:22 +00:00
misc fixes / update 2023-06-20 10:23:31 +00:00			`payloads:`
			`roundcube_path:`
			`- roundcube/logs/sendmail`
entend seen-in-the-wild locations for sendmail I have found several instances where the sendmail log had the the .log filename extension and nuclei did not found it because this widely used location is not present 2024-02-14 23:35:59 +00:00			`- roundcube/logs/sendmail.log`
misc fixes / update 2023-06-20 10:23:31 +00:00			`- roundcube/logs/errors.log`
			`- roundcube/logs/errors`
			`- webmail/logs/sendmail`
entend seen-in-the-wild locations for sendmail I have found several instances where the sendmail log had the the .log filename extension and nuclei did not found it because this widely used location is not present 2024-02-14 23:35:59 +00:00			`- webmail/logs/sendmail.log`
misc fixes / update 2023-06-20 10:23:31 +00:00			`- webmail/logs/errors.log`
			`- webmail/logs/errors`
			`- mail/logs/sendmail`
entend seen-in-the-wild locations for sendmail I have found several instances where the sendmail log had the the .log filename extension and nuclei did not found it because this widely used location is not present 2024-02-14 23:35:59 +00:00			`- mail/logs/sendmail.log`
misc fixes / update 2023-06-20 10:23:31 +00:00			`- mail/logs/errors.log`
			`- mail/logs/errors`
			`- logs/sendmail`
entend seen-in-the-wild locations for sendmail I have found several instances where the sendmail log had the the .log filename extension and nuclei did not found it because this widely used location is not present 2024-02-14 23:35:59 +00:00			`- logs/sendmail.log`
misc fixes / update 2023-06-20 10:23:31 +00:00			`- logs/errors.log`
			`- logs/errors`
			`max-size: 1000`
templateman update 2023-10-14 11:27:55 +00:00
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
misc fixes / update 2023-06-20 10:23:31 +00:00			`part: body`
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00			`words:`
			`- "IMAP Error:"`
More effective Roundcube log disclosure template. 2023-06-08 15:12:16 +00:00			`- "Message for"`
			`- "DB Error:"`
			`- "IMAP Error:"`
			`- "PHP Error:"`
			`- "PHP Warning:"`
			`condition: or`
Update exposures/logs/roundcube-log-disclosure.yaml Co-authored-by: Toufik Airane <toufik.airane@appsectribe.com> 2021-07-22 17:40:43 +00:00
Create roundcube-log-disclosure.yaml 2021-07-21 08:31:09 +00:00			`- type: status`
			`status:`
			`- 200`
misc fixes / update 2023-06-20 10:23:31 +00:00
			`extractors:`
			`- type: dsl`
			`dsl:`
templateman update 2023-10-14 11:27:55 +00:00			`- content_length`
Auto Template Signing [Mon Mar 4 09:35:31 UTC 2024] :robot: 2024-03-04 09:35:31 +00:00			`# digest: 4b0a00483046022100f29f0edc0fd1c21ddc672864cdd1b0e8f9b6bf2fd245e63e3a18e009f87dda4802210094fc7c7162920f3d1b9a810729c4ac860b27bb6b73a4fe837009758cf4ee4fae:922c64590222798bb761d5b6d8e72950`