id: fastcgi-echo

info:
  name: FastCGI Echo Endpoint Script - Detect
  author: powerexploit
  severity: info
  description: |
    FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses.
  remediation: Remove or disable FastCGI module delivered with the Apache httpd server which is incorporated into the Oracle Application Server.FastCGI echo programs (echo and echo2).
  reference:
    - https://www.exploit-db.com/ghdb/183
    - https://www.integrigy.com/oracle-application-server-fastcgi-echo-vulnerability-reports
  classification:
    cpe: cpe:2.3:a:fastcgi:fcgi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fastcgi
    product: fcgi
    google-query: inurl:fcgi-bin/echo
  tags: exposure,logs,oracle,fastcgi,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/fcgi-bin/echo"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>FastCGI echo</title>"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a004630440220568a244d4805784b42fc32a47cdaea6d94e01e969d33fef33c3c05aba18fb7ce02200fc62d2d0744e49b73264c520f0917e7aca29be20b466a6d49f53ea8bafd1b5e:922c64590222798bb761d5b6d8e72950