diff --git a/http/exposed-panels/rails-admin-dashboard-exposure.yaml b/http/exposed-panels/rails-admin-dashboard-exposure.yaml new file mode 100644 index 00000000000..9cfbcaac3e7 --- /dev/null +++ b/http/exposed-panels/rails-admin-dashboard-exposure.yaml @@ -0,0 +1,32 @@ +id: rails-admin-dashboard-exposure + +info: + name: RailsAdmin Dashboard Exposure + author: 0x_Akoko + severity: high + description: | + Detected RailsAdmin dashboard was exposed without proper authentication, allowing unauthorized access to data management interface. + reference: + - https://github.com/railsadminteam/rails_admin + metadata: + max-request: 2 + verified: true + shodan-query: http.html:"RailsAdmin" + fofa-query: body="RailsAdmin" + tags: rails,admin,exposure,misconfig,panel + +http: + - method: GET + path: + - "{{BaseURL}}/admin" + - "{{BaseURL}}/rails_admin" + + stop-at-first-match: true + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_all(body, "