openproject-default-login: OpenProject - Default Admin Credentials

id: openproject-default-login

info:
  name: OpenProject - Default Admin Credentials
  author: 0x_Akoko
  severity: high
  description: |
    Detected OpenProject was found using the default administrator credentials admin:admin. An attacker could gain full administrative control, including user management, project data, and system configuration.
  reference:
    - https://www.openproject.org/docs/installation-and-operations/installation/manual/
    - https://www.openproject.org/docs/api/introduction/
    - https://github.com/opf/openproject
  metadata:
    max-request: 3
    verified: true
    fofa-query: app="OpenProject"
    shodan-query: http.title:"OpenProject"
  tags: openproject,default-login,auth,misconfig

variables:
  username: "admin"
  password: "admin"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf_token
        part: body
        group: 1
        regex:
          - '<meta name="csrf-token" content="([^"]+)"'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 && contains(body, "OpenProject")'
        internal: true

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        authenticity_token={{url_encode(csrf_token)}}&username={{username}}&password={{password}}&login=Sign+in

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
        internal: true

  - raw:
      - |
        GET /api/v3/users/me HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"_type\":\"User\"", "\"admin\":true", "\"login\":\"admin\"")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100bf1342aefce93ed830382d1d2b9cddfd969cf0c9550c6c50cf8daa9d7b3a9d09022100c9f8c1d8ba6cb07a232c67a878ceea2096d4f4527468cba2174c73d652b0a518:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.