perforce-repository: Perforce Repository Disclosure

id: perforce-repository

info:
  name: Perforce Repository Disclosure
  author: DhiyaneshDk
  severity: low
  description: |
    Detected an exposed .p4ignore file, which could have revealed ignored files, sensitive paths, or developer-specific information useful for further enumeration.
  reference:
    - https://help.perforce.com/helix-core/server-apps/cmdref/current/Content/CmdRef/P4IGNORE.html
  metadata:
    max-request: 1
    verified: true
    shodan-query: html:"Perforce"
  tags: exposure,perforce,repo,disclosure

http:
  - method: GET
    path:
      - "{{BaseURL}}/.p4ignore"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "*.log"
          - "yarn-error.log"
        condition: or

      - type: word
        part: content_type
        words:
          - "application/octet-stream"

      - type: dsl
        dsl:
          - "!contains_any(tolower(body), '<html','<body','<!doctype')"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502203d6aedbe40a197d84807e3b3cf3924d3c5cbb2454ad640d44383d252c8febfd2022100f3d3420785175e92d97fb4f0f4cefebf10b6ee6b95ab429da671d030f41dd110:922c64590222798bb761d5b6d8e72950