postgres-history-exposure: PostgreSQL History - Exposure

id: postgres-history-exposure

info:
  name: PostgreSQL History - Exposure
  author: theamanrawat,0x_Akoko
  severity: low
  description: |
    Exposed PostgreSQL history files (.psql_history) were detected. These files contain a record of executed SQL commands and may disclose sensitive information like passwords, database schemas, and query logic.
  reference:
    - https://www.postgresql.org/docs/current/app-psql.html#APP-PSQL-FILES
  metadata:
    verified: true
    max-requests: 3
  tags: postgres,exposure,config,history,database,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.psql_history"
      - "{{BaseURL}}/psql_history"
      - "{{BaseURL}}/.postgresql_history"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!contains(content_type, "text/html")'
          - 'contains_all(to_lower(body), "select", "from", "where")'
          - 'contains_any(body, "select * from", "SELECT * FROM", "insert into", "INSERT INTO", "update ", "UPDATE ")'
          - 'regex("(?m)^\\\\(q|h|\\?|g|d|dt|du|l|c|connect|copy)", body)'
        condition: and
# digest: 490a004630440220686a4a0fd9a92b08c40c34d32eba53f2ecc8812007f5f4f2b9308df48a22e5d00220034335c1bf10021eb69be95bc9afa7b36a98f6159fc798566790a797f3dfa467:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.