Fix exposed-venv-dir template structure

- Fix template section from 'requests' to 'http'
- Add impact and remediation sections
- Fix author format (remove spaces)
- Add proper metadata including verified and max-request
- Clean up tags and improve description formatting
This commit is contained in:
Prince Chaddha
2025-07-30 19:58:56 -05:00
parent 65c1bb4abb
commit 7a000a070b

View File

@@ -2,16 +2,22 @@ id: exposed-venv-dir
info:
name: Exposed Python Virtual Environment Directory
author: Al Baradi Joy
author: albaradijoy
severity: info
description: >
Detects publicly accessible /venv directories, which may expose the Python virtual environment.
These folders typically contain package dependencies and config files like pyvenv.cfg.
description: |
Detects publicly accessible /venv directories, which may expose the Python virtual environment. These folders typically contain package dependencies and config files like pyvenv.cfg.
impact: |
Exposed virtual environment directories can reveal sensitive information about the application dependencies, versions, and configuration.
remediation: |
Restrict access to virtual environment directories by configuring proper web server rules or moving them outside the web root.
reference:
- https://docs.python.org/3/library/venv.html
tags: venv,file-disclosure,python-env,info,sensitive-file
metadata:
verified: true
max-request: 1
tags: exposure,venv,file-disclosure,python
requests:
http:
- method: GET
path:
- "{{BaseURL}}/venv/"