leantime-install-page-exposed: Leantime - Unfinished Installation

id: leantime-install-page-exposed

info:
  name: Leantime - Unfinished Installation
  author: 0x_Akoko
  severity: high
  description: |
   Detected a Leantime instance identified with the setup installation page accessible at /install, enabling unauthenticated users to create the first administrator account and configure the database.
  reference:
    - https://github.com/leantime/leantime
    - https://docs.leantime.io/installation/package-installation
  metadata:
    verified: true
    max-request: 1
    vendor: leantime
    product: leantime
    shodan-query: html:"Leantime" http.title:"Leantime"
    fofa-query: title="Leantime" && body="leantime-version"
  tags: misconfig,install,exposure,leantime

http:
  - method: GET
    path:
      - "{{BaseURL}}/install"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "leantime-version", "create an administrator account")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022014480baafee16dc7853cecccce4dd40dee23648a9434d6a3bdba7875bad27134022100a0b71a1b7667ae7e6bc4eca35e07f1bbdb315c784be2b7ee156f65906b3170f1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.