Fix misconfiguration of ETCD API by ensuring correct response types a… (#6852)

* Fix misconfiguration of ETCD API by ensuring correct response types and body words.

* updated tag

* more tags

---------

Co-authored-by: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
patch-1
Sandeep Singh 2023-03-07 14:36:11 +05:30 committed by GitHub
parent 68a68b929e
commit 3ec1aab852
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 5 deletions

View File

@ -6,26 +6,31 @@ info:
severity: high
reference:
- https://hackerone.com/reports/1088429
tags: hackerone,unauth
tags: misconfig,hackerone,unauth,etcd
requests:
- method: GET
path:
- "{{BaseURL}}/v2/auth/roles"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"roles"'
- '"permissions"'
- '"role"'
- '"kv"'
condition: and
part: body
- type: status
status:
- 200
- type: word
part: header
words:
- "text/plain"
- "application/json"
condition: or
- type: status
status:
- 200