laravel-clockwork-exposure: Laravel Clockwork - Sensitive Information Exposure

id: laravel-clockwork-exposure

info:
  name: Laravel Clockwork - Sensitive Information Exposure
  author: moamenbasel
  severity: medium
  description: |
    Laravel Clockwork (itsgoingd/clockwork) was detected as enabled and publicly accessible. When left active in production, it exposes SQL queries, request data, session variables, mail logs, and application internals to any visitor.
  remediation: |
    Disable Clockwork in production by setting CLOCKWORK_ENABLE=false in the .env file or removing the package from production dependencies.
  reference:
    - https://github.com/itsgoingd/clockwork
    - https://underground.works/clockwork/
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"clockwork" html:"laravel"
  tags: laravel,clockwork,misconfig,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/__clockwork"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"__meta":'
          - '"toolbar":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cba28f870252adc8e83b5c0377b1bbee01ab59062955b36bf5f9800c6adf0d17022100b17237c059c3831329cae6949531a1aef32b9a978d1796a9625373d2e94eb171:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.