magento-downloader-fpd: Magento Downloader - Full Path Disclosure

id: magento-downloader-fpd

info:
  name: Magento Downloader - Full Path Disclosure
  author: 0x_Akoko
  severity: low
  description: |
    Detected Magento Downloader component exposed internal file system paths through direct file access.
  reference:
    - https://magento.com
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 4
    verified: true
  tags: magento,fpd,exposure,disclosure

http:
  - method: GET
    path:
      - "{{BaseURL}}/downloader/lib/Mage/Backup/Nomedia.php"
      - "{{BaseURL}}/downloader/lib/Mage/Archive/Tar.php"
      - "{{BaseURL}}/downloader/lib/Mage/Archive/Gz.php"
      - "{{BaseURL}}/downloader/lib/Mage/Archive/Bz.php"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Fatal error", "not found", "downloader/lib/Mage/")'
          - 'contains_any(body, "Mage_Backup", "Mage_Archive")'
        condition: and
# digest: 4a0a00473045022100faa9d82392db7799c346538b738637410c66dbea579700e8e78a8fbd5ef3abdf02205fe8177cf7bdf9a15e72e44897438323460a45ae6d2c393b3b89555a6c348f2b:922c64590222798bb761d5b6d8e72950