id: glpi-default-login

info:
  name: GLPI Default Login
  author: andysvints
  severity: high
  description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled.
  reference:
    - https://glpi-project.org/
  classification:
    cwe-id: CWE-798
  metadata:
    max-request: 2
  tags: glpi,default-login

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /front/login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}

        {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}}

    attack: pitchfork
    payloads:
      user:
        - glpi
      pass:
        - glpi

    extractors:
      - type: regex
        name: token
        part: body
        internal: true
        group: 1
        regex:
          - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\""

      - type: regex
        name: name
        part: body
        internal: true
        group: 1
        regex:
          - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\""

      - type: regex
        name: password
        part: body
        internal: true
        group: 1
        regex:
          - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\""

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<title>GLPI - Standard Interface</title>'

      - type: status
        status:
          - 200

# digest: 4a0a004730450220756b6e508614433a3afccdcb206aec79b10478a9a3d45b32fc7ec1f2041d35fc022100adb763989b06d6b42d49bd02003348f3b6412a27b13f2cadbd999770d03eeef2:922c64590222798bb761d5b6d8e72950
