postgres-credentials-exposure: PostgreSQL Credentials - Exposure

id: postgres-credentials-exposure

info:
  name: PostgreSQL Credentials - Exposure
  author: theamanrawat
  severity: high
  description: |
    Detects the exposure of PostgreSQL credentials and history files (.pgpass) via HTTP. These files may contain plaintext database usernames and passwords, and their leakage could allow unauthorized access to sensitive databases or internal infrastructure.
  reference:
    - https://www.postgresql.org/docs/current/libpq-pgpass.html
    - https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html#postgresql
  tags: exposure,config,postgres,database,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.pgpass"

    matchers-condition: and
    matchers:
      - type: regex
        name: pgpass
        regex:
          - "([a-zA-Z0-9.-]+):5432:([a-zA-Z0-9_*-]+):([a-zA-Z0-9_-]+):(.+)"

      - type: status
        status:
          - 200
# digest: 490a0046304402204d963d942b2749cd2856f38c5f6dc5409e75daa4071041945be90c7739f11a7e022049cec8d5a518da69f96439a988602e49e03eda1adb3f4506e8c1cdc619d2926b:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.