openstack-config: Openstack - Infomation Disclosure

id: openstack-config

info:
  name: Openstack - Infomation Disclosure
  author: MayankPandey01
  severity: low
  verified: false
  description: |
    Openstack exposing Configuration or settings related to the Swift object storage system.
  reference:
    - https://docs.openstack.org/python-cloudkittyclient/stein/api_reference/info.html
  tags: exposure,misconfig,openstack
  created: 2023/11/30

rules:
  r0:
    request:
      method: GET
      path: /info
    expression: |
      response.status == 200 &&
      response.body.bcontains(b'{"formpost"') &&
      response.body.bcontains(b'bulk_') &&
      response.headers["content-type"].icontains(b'application/json')
  r1:
    request:
      method: GET
      path: /v1/info
    expression: |
      response.status == 200 &&
      response.body.bcontains(b'{"formpost"') &&
      response.body.bcontains(b'bulk_') &&
      response.headers["content-type"].icontains(b'application/json')
expression: r0() || r1()