id: exposed-service-now

info:
  name: ITMS-Misconfigured
  author: dhiyaneshDK
  severity: info
  description: detectes misconfigured Service-now ITSM instances
  reference: https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56

 # Thanks to Th3G3nt3lman for the writeup
 # https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
 # Exploitation :- https://github.com/leo-hildegarde/SnowDownKB/

requests:
  - method: GET
    path:
      - "{{BaseURL}}/kb_view_customer.do?sysparm_article=KB00xxxx"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Unfortunately the article you are looking for could not be found.'
        part: body

      - type: status
        status:
          - 200