fastly-debug-headers: Fastly CDN Debug Headers Exposure

id: fastly-debug-headers

info:
  name: Fastly CDN Debug Headers Exposure
  author: pussycat0x
  severity: low
  description: |
    Detected Fastly CDN debug headers being exposed when the Fastly-Debug header was sent in a request.This exposure disclosed sensitive debugging information such as cache paths, TTL values, content digests, surrogate keys, and cache server identities, which could help attackers understand CDN configuration and cache behavior.
  reference:
    - https://www.fastly.com/documentation/reference/http/http-headers/Fastly-Debug/
  metadata:
    max-request: 1
    verified: true
    shodan-query: 'X-Served-By: cache'
  tags: fastly,cdn,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      Fastly-Debug: "1"

    matchers-condition: or
    matchers:
      - type: regex
        name: fastly-debug-path
        part: header
        regex:
          - '(?i)fastly-debug-path:\s*.+'

      - type: regex
        name: fastly-debug-ttl
        part: header
        regex:
          - '(?i)fastly-debug-ttl:\s*.+'

      - type: regex
        name: fastly-debug-digest
        part: header
        regex:
          - '(?i)fastly-debug-digest:\s*.+'
# digest: 4a0a00473045022100bc1acbc8b113494f0fa3fe06efa5682132bd5e58c45a7db4acde8d0dc75b04fe02200d5db3425739a42c12b33787dc60eb473d2be152053a6d71322ba9cda1e93912:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.