ovhcloud-backup-config: OVHcloud Backup Configuration - Exposure

id: ovhcloud-backup-config

info:
  name: OVHcloud Backup Configuration - Exposure
  author: pussycat0x
  severity: high
  description: |
    Detected exposed OVHcloud backup configuration files (ovh-backups.json) containing sensitive credentials such as OpenStack/Swift authentication details, API keys, and storage configuration.
  reference:
    - https://docs.ovh.com/gb/en/storage/
    - https://docs.ovh.com/gb/en/public-cloud/access_and_security_in_horizon/
  metadata:
    max-request: 4
    verified: true
  tags: ovh,ovhcloud,backup,config,exposure,cloud,openstack,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ovh-backups.json"
      - "{{BaseURL}}/config/ovh-backups.json"
      - "{{BaseURL}}/backup/ovh-backups.json"
      - "{{BaseURL}}/storage/ovh-backups.json"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body,'accessKey','secretKey')"
          - "contains(content_type,'application/json')"
        condition: and

    extractors:
      - type: regex
        name: accesskey
        part: body
        group: 1
        regex:
          - 'accessKey":"([0-9a-z ]+)'
        internal: true

      - type: regex
        name: secretkey
        part: body
        group: 1
        regex:
          - 'secretKey":"([a-z0-9]+)'
        internal: true

      - type: dsl
        dsl:
          - '"accessKey: " + accesskey + " secretKey: "+ secretkey'
# digest: 490a00463044021f35a530b791ca7bb7c3b6a005b01ec22e3997a76f0b09f077f8dfc352c5fdaf022100ddea2cfcf5659298131b5aeb9340a102ae82cd833f7512487ac64c72b5924c56:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.