mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
db862992b5
modules/recon/joomla-config-exposure.yaml flags an exposed configuration.php backup through the JConfig class paired with the password property, so a generic php class is not reported, then extracts the database password. modules/recon/drupal-config-exposure.yaml flags an exposed settings.php backup through the databases array paired with a literal password value, so an array that lacks the marker or resolves the password from the environment is not reported, then extracts the password. modules/recon/magento-config-exposure.yaml flags an exposed app/etc/env.php backup through the crypt or mode marker paired with a literal key or password value, so a generic return array or a cloud placeholder is not reported, then extracts the crypt key. internal/modules/cms_config_exposure_test.go drives the three modules end to end through ExecuteHTTPModule and asserts the leak alongside the near misses a strict review wants pinned: a config missing its password, a generic php class, an array without the databases marker, a databases array with no password, an env indirection password, a return array without a magento marker, a magento config with no credential, a cloud placeholder key, an html tutorial for each file, a plain 200 and a 404. verify: go test ./internal/modules, each matcher and extractor proven to bite (break -> red, restore -> green).
57 lines
1.2 KiB
YAML
57 lines
1.2 KiB
YAML
# Joomla Configuration Backup Exposure Detection Module
|
|
|
|
id: joomla-config-exposure
|
|
info:
|
|
name: Joomla Configuration Backup Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed Joomla configuration.php backup that leaks the database password
|
|
tags: [joomla, cms, config, credentials, recon, exposure]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/configuration.php.bak"
|
|
- "{{BaseURL}}/configuration.php~"
|
|
- "{{BaseURL}}/configuration.php.old"
|
|
- "{{BaseURL}}/configuration.php.save"
|
|
- "{{BaseURL}}/configuration.php.orig"
|
|
- "{{BaseURL}}/configuration.php.txt"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "public $password"
|
|
|
|
- type: word
|
|
part: body
|
|
condition: or
|
|
words:
|
|
- "JConfig"
|
|
- "public $dbprefix"
|
|
- "public $secret"
|
|
- "public $db"
|
|
|
|
- type: word
|
|
part: body
|
|
negative: true
|
|
condition: or
|
|
words:
|
|
- "<!DOCTYPE"
|
|
- "<html"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: joomla_password
|
|
part: body
|
|
regex:
|
|
- "password\\s*=\\s*'([^']+)'"
|
|
group: 1
|