razorpay-clientid-disclosure: Razorpay Client ID Disclosure

日期: 2025-08-01 | 影响软件: Razorpay Client | POC: 已公开

漏洞描述

Razorpay Client ID is exposed to external users.

PoC代码[已公开]

id: razorpay-clientid-disclosure

info:
  name: Razorpay Client ID Disclosure
  author: Devang-Solanki
  severity: high
  description: Razorpay Client ID is exposed to external users.
  reference:
    - https://github.com/streaak/keyhacks#Razorpay-keys
    - https://docs.gitguardian.com/secrets-detection/detectors/specifics/razorpay_apikey
  metadata:
    max-request: 1
  tags: exposure,token,razorpay,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        part: body
        regex:
          - "rzp_(live|test)_.{14}"
# digest: 4a0a00473045022014c9d639a604746aa4986039be7a88d4d2274c5ad7adce6437e2edaf4e132e70022100906e717aa58185baadac94c93c0b7aca4650d76f4cc7c7f04ef345881205571e:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/tokens/razorpay/razorpay-clientid-disclosure.yaml

相关漏洞推荐