From d29462a14de8586cd0b893c61dd90a0621c1322f Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Fri, 25 Nov 2022 16:04:54 +0530 Subject: [PATCH 1/2] Create symfony-fosjrouting-bundle.yaml --- .../symfony-fosjrouting-bundle.yaml | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 misconfiguration/symfony-fosjrouting-bundle.yaml diff --git a/misconfiguration/symfony-fosjrouting-bundle.yaml b/misconfiguration/symfony-fosjrouting-bundle.yaml new file mode 100644 index 0000000000..be1a5932f0 --- /dev/null +++ b/misconfiguration/symfony-fosjrouting-bundle.yaml @@ -0,0 +1,35 @@ +id: symfony-fosjrouting-bundle + +info: + name: Symfony FOSJsRoutingBundle + author: DhiyaneshDk + severity: medium + reference: + - https://packagist.org/packages/friendsofsymfony/jsrouting-bundle + metadata: + verified: true + shodan-query: http.html:"symfony Profiler" + tags: symfony + +requests: + - method: GET + path: + - '{{BaseURL}}/js/routing?callback=fos.Router.setDatafoobarfoo' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '/**/fos.Router.setDatafoobarfoo({' + - 'routes' + condition: and + + - type: word + part: header + words: + - "application/javascript" + + - type: status + status: + - 200 From b31da09fa155575eadc563f51582b99d634d12da Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Sat, 26 Nov 2022 22:09:19 +0530 Subject: [PATCH 2/2] Update symfony-fosjrouting-bundle.yaml --- misconfiguration/symfony-fosjrouting-bundle.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/misconfiguration/symfony-fosjrouting-bundle.yaml b/misconfiguration/symfony-fosjrouting-bundle.yaml index be1a5932f0..89776e7bcc 100644 --- a/misconfiguration/symfony-fosjrouting-bundle.yaml +++ b/misconfiguration/symfony-fosjrouting-bundle.yaml @@ -3,13 +3,13 @@ id: symfony-fosjrouting-bundle info: name: Symfony FOSJsRoutingBundle author: DhiyaneshDk - severity: medium + severity: low reference: - https://packagist.org/packages/friendsofsymfony/jsrouting-bundle metadata: verified: true shodan-query: http.html:"symfony Profiler" - tags: symfony + tags: misconfig,symfony requests: - method: GET