Merge pull request #9321 from Michal-Mikolas/htdeployment

.htdeployment - files tree cache file

http/exposures/files/ht-deployment.yaml

@@ -0,0 +1,43 @@
+id: ht-deployment
+
+info:
+  name: .htdeployment - Files Tree Cache File
+  author: Michal-Mikolas
+  severity: medium
+  description: |
+    FTP Deployment cache file that contains whole files structure with paths to potentially sensitive files.
+  remediation: Block access to the file using `.htaccess` on the server. The best-practise is to block all the folders/files beginning with `.` except `.well-known` folder.
+  reference:
+    - https://github.com/dg/ftp-deployment/tree/master
+    - https://github.com/dg/ftp-deployment/blob/master/src/Deployment/Deployer.php#L206
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+  metadata:
+    verified: true
+    vendor: dg
+    product: ftp-deployment
+    max-request: 2
+  tags: files,exposure,php,deployment,cache
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htdeployment"
+      - "{{BaseURL}}/.deployment"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "[config]"
+          - "1F 8B"
+        condition: or
+
+      - type: word
+        part: header
+        words:
+          - "application/octet-stream"
+          - "text/plain"
+        condition: or