id: exposed-service-now

info:
  name: ITMS-Misconfigured
  author: dhiyaneshDK
  severity: info
  description: Detection of misconfigured ServiceNow ITSM instances.
  reference:
    - https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
    - https://github.com/leo-hildegarde/SnowDownKB/
  metadata:
    max-request: 1
  tags: misconfig,servicenow

http:
  - method: GET
    path:
      - "{{BaseURL}}/kb_view_customer.do?sysparm_article=KB00xxxx"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Unfortunately the article you are looking for could not be found.'
        part: body

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f168a5aecdaef437dc033145212b2e359c8fdaa992c67189288f3ed5fe96752e0221008b06433124b03b79f154633f36a5c160edf3f5cc0c5c0c7b6bcb0e951431c0ce:922c64590222798bb761d5b6d8e72950