id: fastcgi-config

info:
  name: FastCGI Configuration - File Disclosure
  author: DhiyaneshDk
  severity: medium
  description: |
    FastCGI configuration file is exposed and accessible, potentially leading to sensitive information disclosure.
  metadata:
    verified: true
    max-request: 2
  tags: fastcgi,config,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/fastcgi.conf"
      - "{{BaseURL}}/config/fastcgi.conf"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, 'fastcgi_param','fastcgi_script')
          - contains(content_type, 'application/octet-stream')
        condition: and
# digest: 4a0a00473045022100e74e1be53688988986a9b33c7da04276ec1e10a6a2531ef2fc1dc022aecc1e78022060f23f198f9c33587833f77318c9635351e38c2a6b9be67558511ab4499a251a:922c64590222798bb761d5b6d8e72950