id: drupal-jsonapi-user-listing

info:
  name: Drupal JSON:API Username Listing - Detect
  author: lixts
  severity: medium
  description: Drupal JSON:API username listing was detected via the /user/user endpoint.
  reference:
    - https://www.drupal.org/project/drupal/issues/3240913
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - http.component:"drupal"
      - cpe:"cpe:2.3:a:drupal:drupal"
    product: drupal
    vendor: drupal
  tags: drupal,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/jsonapi/user/user"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"display_name":"([A-Sa-z0-9-_]+)"\}'

      - type: status
        status:
          - 200

    extractors:
      - type: json
        json:
          - '.data[].attributes.display_name'
# digest: 4a0a00473045022100a7e6ad47f602be45d092d389755500dfc1f355e0cbd507d7a9391a81220e8b020220609b05ffa47f540784f3b8c943d5201e09a44dd4ed1a8862612311af8601da34:922c64590222798bb761d5b6d8e72950