id: lvmeng-uts-disclosure

info:
  name: Lvmeng - UTS Disclosure
  author: pikpikcu
  severity: high
  description: Lvmeng UTS was discovered.
  metadata:
    max-request: 1
  tags: config,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/v1/system/accountmanage/account"

    headers:
      Content-Type: application/json

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "application/json"
        condition: and
        part: header

      - type: word
        words:
          - "password"
          - "nsfocus_uts"
          - "MANAGER_IP"
        condition: and
        part: body

# digest: 4b0a00483046022100d844e7f33e8cc96e984aded5c84b8923bded7a90ccb1255b56225348d182e372022100b618cc55d05761cd2745dfec867419c0f4ae508c3ffaeb5931fe1b205e3bba11:922c64590222798bb761d5b6d8e72950