id: imm-default-login

info:
  name: Integrated Management Module - Default Login
  author: jpg0mez
  severity: high
  description: |
    Integrated Management Module default login credentials were discovered.
  reference:
    - https://pubs.lenovo.com/x3650-m4/t_logging_web_interface
    - https://www.ibm.com/docs/en/tcs-service?topic=oip-logging-imm-web-interface
  classification:
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ibmdojo"
    fofa-query: "integrated management module"
  tags: imm,ibm,default-login

http:
  - method: POST
    path:
      - "{{BaseURL}}/data/login"
    body: "user=USERID&password=PASSW0RD"

    redirects: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<authResult>0</authResult>"
          - 'authResult":"0'
        condition: or

      - type: word
        words:
          - "index-console.php"
          - "home.php"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022053455cd067d472404c212995c8e43ae6c2601b35991e2e769b761a53657e2af8022100eb5d63b688fc790d2e11e68ce980539dd706d1a1de76cbaf28c8a624ffb767c8:922c64590222798bb761d5b6d8e72950