id: laravel-log-file

info:
  name: Laravel log file publicly accessible
  author: sheikhrishad,geeknik
  severity: high
  description: The log file of this Laravel web app might reveal details on the inner workings of the app, possibly even tokens, credentials or personal information.
  reference:
    - https://laravel.com/docs/master/logging
  metadata:
    max-request: 1
  tags: laravel,logs,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/logs/laravel.log"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "InvalidArgumentException"
          - "local.ERROR"
          - "ErrorException"
          - "syntax error"
        condition: or

      - type: word
        part: header
        words:
          - "text/plain"
          - "text/x-log"
        condition: or

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100b0fce74f167a40ba4645dab793e58cb86f6ff71560b7f07669742469b5e0b7d40220182c1088c71f30cffa3615e8eb8faf0ca6edb3c75d8dd5e626e40f9ec4677b4a:922c64590222798bb761d5b6d8e72950