javascript-env: JavaScript Environment Configuration - Detect

id: javascript-env

info:
  name: JavaScript Environment Configuration - Detect
  author: pdp,geeknik,hetyh,s4e-io
  severity: low
  description: Multiple common JavaScript environment configuration files were detected.
  metadata:
    max-request: 8
  tags: javascript,config,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/env.js"
      - "{{BaseURL}}/env.development.js"
      - "{{BaseURL}}/env.production.js"
      - "{{BaseURL}}/env.test.js"
      - "{{BaseURL}}/env.dev.js"
      - "{{BaseURL}}/env.prod.js"
      - "{{BaseURL}}/__ENV.js"
      - "{{BaseURL}}/env-config.js"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - "contains(tolower(content_type), 'application/javascript')"

      - type: word
        part: body
        words:
          - "module.exports"
          - "const audience"
          - "const domain"
          - "NODE_ENV"
          - "LOG_LEVEL"
          - "TOKEN"
          - "KEY"
          - "PASSWORD"
          - "VERSION"
          - "window.__ENV ="
        condition: or

      - type: word
        part: body
        words:
          - "Bootstrap"
          - "jQuery"
          - "CSS TRANSITION SUPPORT"
          - "is_ad_blocked"
        condition: or
        negative: true
# digest: 4b0a00483046022100a40edadbd8c815a585aba9c8fc84b4f1f23d4ae9f89924af8fbdfcb090b49032022100e670cc4c4f817c067cb5f9138363402318da960cabfb0b962dcd6fcb6f8408ff:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.