laravel-passport-keys-exposed: Laravel Passport - OAuth2 Keys Exposed

id: laravel-passport-keys-exposed

info:
  name: Laravel Passport - OAuth2 Keys Exposed
  author: moamenbasel
  severity: high
  description: |
    Laravel Passport OAuth2 RSA private or public keys are publicly accessible at default storage paths. Exposed private keys allow attackers to forge OAuth2 access tokens and impersonate any user.
  remediation: |
    Ensure the storage directory is not publicly accessible. Move Passport keys outside the web root or configure the web server to deny access to the storage directory.
  reference:
    - https://laravel.com/docs/10.x/passport#installation
  metadata:
    verified: true
    max-request: 2
  tags: laravel,passport,oauth,exposure,keys

http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/oauth-private.key"
      - "{{BaseURL}}/storage/oauth-public.key"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "-----BEGIN RSA PRIVATE KEY-----"
          - "-----BEGIN PUBLIC KEY-----"
        condition: or

      - type: word
        part: body
        words:
          - "<html"
          - "<!DOCTYPE"
        negative: true

      - type: status
        status:
          - 200
# digest: 490a0046304402207015db543a53bc4a6cf47020c99acd39b27cb3ca1e56876360c7fe2f12022a320220588250086548f097d18559687a5abde278de3ea6a3c927a4d5a594cc02d8192a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.