mistserver-installer: MistServer Installation Wizard - Exposure

id: mistserver-installer

info:
  name: MistServer Installation Wizard - Exposure
  author: DhiyaneshDk
  severity: high
  description: |
    MistServer installation/setup wizard is publicly accessible, allowing unauthorized users to create admin accounts and take full control of the streaming server. This is a first-user-wins vulnerability.
  reference:
    - https://docs.mistserver.org/mistserver/configuration
    - https://mistserver.org/
  impact: |
    An attacker can create an admin account on unconfigured MistServer instances,
    gaining full control over the streaming server configuration and content.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"MistServer"
    fofa-query: title="MistServer"
    product: mistserver
    vendor: ddvtech
  tags: misconfig,mistserver,install,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "MistServer"
          - "Management Interface"
        condition: and

      - type: word
        part: body
        words:
          - "Create new account"
          - "No account has been created yet"
          - "Select other host"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d5ab68393fd87d13255f0be1fef51cc689d17e942562e3c55ac66d8e7101cc5f02203124b201fc9386ec4907da77fea9300e5c79350012e71bc221b3e01db9fcf741:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.