mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
12b56661ac
probe /_all_dbs instead of the / welcome banner: couchdb serves the banner publicly even on a secured 3.x, so a 200 there only proves an instance is reachable. /_all_dbs is admin-gated by default since 3.0 (admin_only_all_dbs), so a 200 listing means the database names are readable without auth on every version, while a secured server returns 401. the match requires a json array carrying a system database (_users, _replicator or _global_changes), which keeps non-couchdb arrays and prose clean. no version is extracted: the /_all_dbs array carries no version string. instances with renamed or deleted system databases are not matched.
35 lines
583 B
YAML
35 lines
583 B
YAML
# CouchDB Exposure Detection Module
|
|
|
|
id: couchdb-exposure
|
|
info:
|
|
name: CouchDB Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed unauthenticated CouchDB database list
|
|
tags: [couchdb, datastore, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/_all_dbs"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '^\s*\['
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"_users"'
|
|
- '"_replicator"'
|
|
- '"_global_changes"'
|
|
condition: or
|