craftcms-debug-exposure: CraftCMS Debug Methods Exposed

id: craftcms-debug-exposure

info:
  name: CraftCMS Debug Methods Exposed
  author: 0x_Akoko
  severity: medium
  description: |
    Detected CraftCMS with devMode enabled, which exposed the Yii2 debug toolbar and sensitive information. This misconfiguration could have leaked database queries, session data, cookies, stack traces, CSRF tokens, and internal application details to unauthenticated users.
  reference:
    - https://craftcms.com/docs/5.x/system/config.html#devmode
    - https://www.acunetix.com/vulnerabilities/web/craft-cms-development-mode-enabled/
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.component:"Craft CMS"
    fofa-query: app="Craft-CMS"
  tags: craftcms,debug,misconfiguration,exposure,yii2,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/actions/debug/default/index"
      - "{{BaseURL}}/actions/debug/default/toolbar"
      - "{{BaseURL}}/actions/debug/default/view"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "Yii Debugger", "yii-debug-toolbar", "Available Debug Data")'
          - 'contains(header, "Craft CMS") || contains(body, "cpresources")'
        condition: and
# digest: 4b0a00483046022100dbe710db81ac7ab1edb83701899396e80ecc6002ea2e4458140df051ba0e7ee702210096c99d17020b856b69c5b075b45b493c0bc007184f1e8078b607db8d1e44a549:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.