Delete http/exposures/configs/symfony-profiler-exposed.yaml

patch-11
Ritik Chaddha 2024-09-18 07:55:37 +04:00 committed by GitHub
parent 0f165ce9ce
commit 5a657fa755
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 0 additions and 50 deletions

View File

@ -1,50 +0,0 @@
id: symfony-profiler
info:
name: Symfony Profiler - Exposure
author: pdteam
severity: high
description: Symfony profiler was detected.
reference:
- https://symfony.com/doc/current/profiler.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-200
metadata:
verified: true
max-request: 19
shodan-query: html:"symfony Profiler"
tags: config,exposure,symfony,debug
http:
- method: GET
path:
- "{{BaseURL}}/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/app_dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/index.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/index_dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/debug.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/_debug/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/web/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/public/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/frontend_dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/backend_dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/api_dev.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/app.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/app_test.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/test.php/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/symfony/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/debug/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/dev/_profiler/empty/search/results?limit=10"
- "{{BaseURL}}/profiler/empty/search/results?limit=10"
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'contains_any(body, "Symfony Profiler", "<title>Profiler</title>", "Symfony-Debug-Toolbar")'
- 'contains_any(body, "Profile Search</h2>")'
- 'status_code == 200'
condition: and