glitchtip-public-signup: Gitea Public Registration Enabled

id: glitchtip-public-signup

info:
  name: Gitea Public Registration Enabled
  author: DhiyaneshDk
  severity: medium
  description: |
    A misconfiguration in GlitchTip allows arbitrary users to sign up.
  reference:
    - https://glitchtip.com/documentation/install
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"GlitchTip"
  tags: misconfig,glitchtip,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/settings/'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"enableUserRegistration": true'
          - 'enableSocialAppsUserRegistration'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502206f3b8ffd6733a3f7cee70cb7837fef4331245e033598f46e67aaca2f51c41f910221009e59f82ce8a73956b5b69130245420fd76965cc0e9ad90e07a58ba1dfd5a452a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.