pear-registry-exposed: PEAR Registry Files Exposed

id: pear-registry-exposed

info:
  name: PEAR Registry Files Exposed
  author: pussycat0x
  severity: low
  description: |
    Detected exposed PEAR registry files (.reg) containing serialized PHP metadata, including package versions and local paths. This exposure facilitated supply-chain reconnaissance by revealing installed dependencies and system mappings.
  reference:
    - https://pear.php.net/manual/en/core.pear.pear-registry.php
    - https://github.com/pear/pear-core/blob/master/PEAR/Registry.php
    - https://blog.sonarsource.com/php-supply-chain-attack-on-pear/
  metadata:
    max-request: 4
    verified: false
  tags: misconfig,pear,php,registry,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.registry/pear.reg.ber"
      - "{{BaseURL}}/.registry/pear.reg"
      - "{{BaseURL}}/PEAR/.registry/pear.reg.ber"
      - "{{BaseURL}}/PEAR/.registry/pear.reg"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'install-pear.php','PEAR_ErrorStack','install-pear-nozlib.phar')"
        condition: and
# digest: 4a0a00473045022100a0e2d8e72cd07bada0456d962fc4d8ad5f5236f2ed9f9736031313f6359472990220454c495b3d327474f4ccc613f63975f66f3bb2d0ea70e887644d55915d24fd90:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.