aspnet-launchsettings-exposure: ASP.NET Launch Settings - Exposure

id: aspnet-launchsettings-exposure

info:
  name: ASP.NET Launch Settings - Exposure
  author: theamanrawat
  severity: medium
  description: |
    Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information.
  reference:
    - https://learn.microsoft.com/en-us/aspnet/core/fundamentals/environments
  tags: aspnet,config,exposure,json,dotnet

http:
  - method: GET
    path:
      - "{{BaseURL}}/Properties/launchSettings.json"
      - "{{BaseURL}}/launchSettings.json"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "profiles"
          - "iisSettings"
          - "commandName"
          - "launchBrowser"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a0046304402201e1d02fe4f83f1fb39cd963ac1c96cdbd32b071891e9827d3b235b61d6ab9291022036ee12edaa017c8afc89e61bc5bb2ecdd6563afbf17101f344a2562542a47b74:922c64590222798bb761d5b6d8e72950