mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
80c2574800
detect a reachable postfixadmin setup.php (unhardened-install signal and info disclosure, not an auth bypass since superadmin creation is gated on a locally configured setup password) and the login panel. markers and the setup-password form field and login field pair with the brand string so prose mentions do not match.
39 lines
1.1 KiB
YAML
39 lines
1.1 KiB
YAML
# PostfixAdmin Setup Page Exposure Detection Module
|
|
|
|
id: postfixadmin-setup-exposure
|
|
info:
|
|
name: PostfixAdmin Setup Page Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects a reachable PostfixAdmin setup.php that discloses hosting/environment checks and install state unauthenticated. Since PostfixAdmin 2.3 the setup password gate blocks remote superadmin creation without the configured setup_password, so this is an information-disclosure and unhardened-install signal rather than a direct authentication bypass.
|
|
tags: [postfixadmin, mail, mailserver, admin, setup, install, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/setup.php"
|
|
- "{{BaseURL}}/postfixadmin/setup.php"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
condition: and
|
|
words:
|
|
- 'name="setup_password"'
|
|
- "Postfix Admin"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: postfixadmin_setup_state
|
|
part: body
|
|
regex:
|
|
- "(You need to have a setup_password hash configured)"
|
|
- "(setup_password configured)"
|
|
group: 1
|