pypirc-credentials-exposure: Python .pypirc Credentials - Exposure

id: pypirc-credentials-exposure

info:
  name: Python .pypirc Credentials - Exposure
  author: ChrisJr404
  severity: high
  description: |
    Detected A Python .pypirc configuration file is exposed. This file stores the credentials used by tools like twine and setuptools to upload packages to PyPI or a private package index, and it commonly holds a plaintext password or an upload API token.
  reference:
    - https://packaging.python.org/en/latest/specifications/pypirc/
    - https://twine.readthedocs.io/en/stable/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-522
  metadata:
    verified: false
    max-request: 2
    google-query: intitle:"index of" ".pypirc"
  tags: exposure,config,pypi,python,credentials,files

http:
  - raw:
      - |
        GET /.pypirc HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /.config/.pypirc HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /.pypirc.bak HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "[distutils]"
          - "[pypi]"
          - "[testpypi]"
        condition: or

      - type: word
        part: body
        words:
          - "password"
          - "username"
        condition: or

      - type: word
        part: body
        words:
          - "MongoDB over HTTP on the native"
          - "application/javascript"
          - "application/x-javascript"
          - "application/json"
          - "application/xml"
          - "text/xml"
          - "<html"
          - "<!doctype"
          - "<script"
          - "<meta"
          - "image/"
          - "Response xmlns"
        condition: or
        negative: true
# digest: 4b0a00483046022100f0e3f7f7faac586d31f97dd5c3d1e11c1e373cfa46a7baa771f455c5a9d914ad022100f2c23442a16d2132582cee0c9b930a9bde0ed18317eab582ca988d1580aeef27:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.