google-gemini-key-exposure: Google Gemini API Key - Exposure

id: google-gemini-key-exposure

info:
  name: Google Gemini API Key - Exposure
  author: Mestizo
  severity: high
  description: |
    Detects exposed Google API keys and verifies access to the Gemini Files API endpoint. Exploitation can result in unauthorized data exposure, quota exhaustion, and potential financial loss.
  metadata:
    max-request: 2
    verified: true
  tags: exposure,google,apikey,gemini

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        name: google_api_key
        part: body
        regex:
          - 'AIza[0-9A-Za-z\-_]{35}'
        internal: true

  - method: GET
    path:
      - "https://generativelanguage.googleapis.com/v1beta/files?key={{google_api_key}}"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - '!contains(body, "error")'
          - '!status_code == 403'
        condition: and
# digest: 490a00463044022013e16f4f16e6b1ea7e1a61d64179ebdaa3eddfe6421eb9b46436e1c1014ee49902206d7a9a4846fc634386e0df9efa64b931d0e77828500de067d67560fc73601514:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.