From b18a05eb04cdda7c4fa45486a05b12b7633da900 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Sat, 17 Aug 2024 23:36:35 +0530
Subject: [PATCH] Update and rename lidarr-settings-indexers.yaml to
 http/misconfiguration/lidarr-dashboard-unauth.yaml

---
 .../lidarr-dashboard-unauth.yaml              | 36 +++++++++++++++++++
 lidarr-settings-indexers.yaml                 | 25 -------------
 2 files changed, 36 insertions(+), 25 deletions(-)
 create mode 100644 http/misconfiguration/lidarr-dashboard-unauth.yaml
 delete mode 100644 lidarr-settings-indexers.yaml

diff --git a/http/misconfiguration/lidarr-dashboard-unauth.yaml b/http/misconfiguration/lidarr-dashboard-unauth.yaml
new file mode 100644
index 0000000000..777e9ccbe6
--- /dev/null
+++ b/http/misconfiguration/lidarr-dashboard-unauth.yaml
@@ -0,0 +1,36 @@
+id: lidarr-dashboard-unauth
+
+info:
+  name: Lidarr Dashboard - Unauthenticated
+  author: ProjectDiscoveryAI
+  severity: medium
+  description: |
+    Exposed Lidarr was detected which can lead to sensitive information disclosure.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: title:"Lidarr"
+  tags: lidarr,dashboard,exposure
+
+http:
+  - raw:
+      - |
+        GET /settings/indexers HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<title>Lidarr</title>"
+
+      - type: word
+        part: body
+        words:
+          - "Login - Lidarr"
+        negative: true
+
+      - type: status
+        status:
+          - 200
diff --git a/lidarr-settings-indexers.yaml b/lidarr-settings-indexers.yaml
deleted file mode 100644
index 0f275f4c36..0000000000
--- a/lidarr-settings-indexers.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-id: lidarr-settings-indexers
-
-info:
-  name: Lidarr Settings Indexers Exposure
-  author: ProjectDiscoveryAI
-  severity: medium
-  description: |
-    This template checks for exposed Lidarr indexer settings which can lead to sensitive information disclosure.
-
-http:
-  - raw:
-      - |
-        GET /lidarr/settings/indexers HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "Lidarr"
-          - "Indexer"
-          - "Settings"
\ No newline at end of file