feat(modules): add chartmuseum and verdaccio registry exposure modules (#300)

* feat(modules): add chartmuseum and verdaccio registry exposure modules * chore(modules): trim redundant module header comments drop the top-line comments on the new package registry exposure modules that just restated the id/name fields already in the info block
2026-07-28 14:37:01 -07:00 · 2026-07-22 12:48:03 -07:00
parent cb65f868c3
commit 5444090ea4
3 changed files with 198 additions and 0 deletions
@@ -0,0 +1,47 @@
+id: chartmuseum-index-exposure
+info:
+  name: ChartMuseum Index Exposure
+  author: sif
+  severity: medium
+  description: Detects an exposed ChartMuseum helm chart repository that lets anyone list and download every stored chart through its index
+  tags: [chartmuseum, helm, kubernetes, package-registry, information-disclosure, exposure, unauth, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/index.yaml"
+
+  matchers:
+    - type: status
+      status:
+        - 200
+
+    - type: word
+      part: body
+      words:
+        - "apiVersion"
+        - "entries:"
+        - "serverInfo"
+      condition: and
+
+    - type: word
+      part: body
+      negative: true
+      condition: or
+      words:
+        - "<!DOCTYPE"
+        - "<!doctype"
+        - "<html"
+        - "<HTML"
+        - "<head>"
+        - "<title>"
+
+  extractors:
+    - type: regex
+      name: chartmuseum_generated
+      part: body
+      regex:
+        - 'generated:\s*"?([0-9TZ:.+-]+)"?'
+      group: 1
@@ -0,0 +1,49 @@
+id: verdaccio-packages-exposure
+info:
+  name: Verdaccio Packages Exposure
+  author: sif
+  severity: medium
+  description: Detects an exposed Verdaccio private npm registry that lets anyone enumerate every locally published package through its web api
+  tags: [verdaccio, npm, registry, package-registry, information-disclosure, exposure, unauth, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/-/verdaccio/data/packages"
+
+  matchers:
+    - type: status
+      status:
+        - 200
+
+    - type: regex
+      part: header
+      regex:
+        - '(?i)content-type:\s*application/json'
+
+    - type: regex
+      part: body
+      regex:
+        - '^\s*\['
+
+    - type: word
+      part: body
+      negative: true
+      condition: or
+      words:
+        - "<!DOCTYPE"
+        - "<!doctype"
+        - "<html"
+        - "<HTML"
+        - "<head>"
+        - "<title>"
+
+  extractors:
+    - type: regex
+      name: verdaccio_package
+      part: body
+      regex:
+        - '"name"\s*:\s*"([^"]+)"'
+      group: 1