bugzilla-config: Bugzilla - Config Exposed

id: bugzilla-config

info:
  name: Bugzilla - Config Exposed
  author: icarot
  severity: low
  description: |
    Because the config.cgi is publicly exposed, it is possible to enumerate main domain and possible users registered on Bugzilla server.
  reference:
    - https://github.com/bugzilla/bugzilla/
  classification:
    cpe: cpe:2.3:a:mozilla:bugzilla:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mozilla
    product: bugzilla
    shodan-query: title:"Bugzilla"
  tags: bugzilla,mozilla,config,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/config.cgi"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "base_url", "maintainer")'
          - 'contains(content_type, "application/x-javascript")'
        condition: and

    extractors:
      - type: regex
        name: base_url
        group: 1
        part: body
        regex:
          - ".+base_url.+:.(?<base_url>\\'.+\\')"

      - type: regex
        name: maintainer
        group: 1
        part: body
        regex:
          - ".+maintainer.+:.(?<maintainer>\\'.+\\')"
# digest: 4a0a00473045022078a836d8f65f5e24b8ec5847d82d3608817277d2f5b022e9c0f8820452da051b022100865984c47a9b161e2da0bf029397427051e1d1185b4e9e2320f1d53e9091a168:922c64590222798bb761d5b6d8e72950