postman-collection-exposure: Postman Collection Exposure

id: postman-collection-exposure

info:
  name: Postman Collection Exposure
  author: Hamza Sahin
  severity: low
  description: |
    Detected exposed Postman collection JSON files that contained API endpoints and environment details. These files were publicly accessible and disclosed authentication headers and other sensitive information.
  reference:
    - https://medium.com/@utkarshporwal24/exposed-postman-collections-ed6086b96ba5
  classification:
    cwe-id: CWE-538
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"postman.json"
  tags: api,postman,exposure,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/postman.json"
      - "{{BaseURL}}/docs/postman.json"
      - "{{BaseURL}}/api/postman.json"
      - "{{BaseURL}}/postman_collection.json"
      - "{{BaseURL}}/collections/postman.json"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)content-type:\s*application/(json|vnd\.postman\.[^;\s]+)'

      - type: regex
        part: body
        regex:
          - '(?i)"info"\s*:\s*\{\s*"name"\s*:\s*".+?"'

      - type: regex
        part: body
        regex:
          - '(?i)"item"\s*:\s*\['

      - type: status
        status:
          - 200
# digest: 490a00463044022004bd3403a9540a9a2816831fdddf3aab459099794b75b547b7b3d2dfb85adfc7022059f1f7d6449337b043f46c0f870dbb102b1b20754992723c88666a415fa5b61a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.