openvpn-as-config-exposure: OpenVPN Access Server - Configuration Exposure

id: openvpn-as-config-exposure

info:
  name: OpenVPN Access Server - Configuration Exposure
  author: 0x_Akoko
  severity: high
  description: |
    Detected OpenVPN Access Server with sensitive configuration data exposed, including VPN client profiles, certificates, private keys, and session tokens, without authentication.
  reference:
    - https://openvpn.net/vpn-server-resources/access-server-rest-api/
  metadata:
    max-request: 2
    verified: true
    shodan-query: http.title:"OpenVPN Access Server"
    fofa-query: title="OpenVPN Access Server"
  tags: openvpn,config,exposure,misconfig,vpn,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/GetUserlogin"
      - "{{BaseURL}}/rest/GetAutologin"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/x-openvpn-profile")'
          - 'contains_all(body, "-----BEGIN PRIVATE KEY-----", "-----BEGIN CERTIFICATE-----", "OVPN_ACCESS_SERVER")'
        condition: and
# digest: 4a0a00473045022100afd8bb18aa075648b4062affea18ddb73c65f3f9b53726514324f6650cc22a010220082a0d022275bc7eaa5e3fcf145c912d56d8d533bb12cd1749911d26f909009f:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.