id: exposed-alps-spring

info:
  name: Exposed Spring Data REST Application-Level Profile Semantics (ALPS)
  author: dwisiswant0
  severity: medium
  description: Exposed Spring Data profile semantics is exposed.
  reference:
    - https://niemand.com.ar/2021/01/08/exploiting-application-level-profile-semantics-apls-from-spring-data-rest/
  metadata:
    max-request: 3
  tags: exposure,spring,files

http:
  - method: GET
    path:
      - "{{BaseURL}}/profile"
      - "{{BaseURL}}/api/profile"
      - "{{BaseURL}}/alps/profile"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "_links"
          - "/alps/"
          - "profile"
        condition: and
        part: body

      - type: word
        words:
          - "application/hal+json"
        part: header

      - type: status
        status:
          - 200
# digest: 490a004630440220080a78ab13967b0704525f6ad806f5202aa4aa0bdfe106eee4705f48ea8f34c802200588d3fd127e57b57cbaaac91aff32e17871c58f54d228aec429713b299bfcf2:922c64590222798bb761d5b6d8e72950