umbraco-miniprofiler-exposure: Umbraco Mini Profiler - Exposure

id: umbraco-miniprofiler-exposure

info:
  name: Umbraco Mini Profiler - Exposure
  author: theamanrawat
  severity: low
  description: |
    Detected the exposure of the MiniProfiler debugging interface in Umbraco CMS. When exposed, it can reveal sensitive information including SQL queries, execution times, stack traces, and internal application details.
  reference:
    - https://miniprofiler.com/
    - https://umbraco.com/
  metadata:
    shodan-query: http.title:"Umbraco"
    fofa-query: title="Umbraco"
  tags: umbraco,miniprofiler,exposure,debug,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/mini-profiler-resources/results"
      - "{{BaseURL}}/umbraco/mini-profiler-resources/results"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "StartupProfiler"
          - "var profiler ="
          - '"DurationMilliseconds"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e7617e6cd793f08fa24b61ebe7184097eee7c8e3971ae10981ca17f363a421ba022100c0e3a3c6a6ecb2aff2b157310e95052838193a3ebcabc080e9fb0f81225bcc7a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.