id: drupal-jsonapi-user-listing

info:
  name: Drupal JSON:API Username Listing - Detect
  author: lixts
  severity: medium
  description: Drupal JSON:API username listing was detected via the /user/user endpoint.
  reference:
    - https://www.drupal.org/project/drupal/issues/3240913
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"drupal"
  tags: drupal,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/jsonapi/user/user"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"display_name":"([A-Sa-z0-9-_]+)"\}'

      - type: status
        status:
          - 200

    extractors:
      - type: json
        json:
          - '.data[].attributes.display_name'

# digest: 4a0a0047304502202a3faa8458891661b4df79d36c41ed4e1ebf307488e8e6dea3397ac0865cea29022100f9b95fd691e9b275a29f838e75d5131c3808cc86c4ca6a5ae2e4efb0d6bdfe49:922c64590222798bb761d5b6d8e72950