id: drupal-jsonapi-user-listing

info:
  name: Drupal JSON:API Username Listing - Detect
  author: lixts
  severity: medium
  description: Drupal JSON:API username listing was detected via the /user/user endpoint.
  reference:
    - https://www.drupal.org/project/drupal/issues/3240913
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - http.component:"drupal"
      - cpe:"cpe:2.3:a:drupal:drupal"
    product: drupal
    vendor: drupal
  tags: drupal,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/jsonapi/user/user"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"display_name":"([A-Sa-z0-9-_]+)"\}'

      - type: status
        status:
          - 200

    extractors:
      - type: json
        json:
          - '.data[].attributes.display_name'
# digest: 4b0a00483046022100ad93da9a20f0fa6772d792b192d4250d45b907ad5218b8ce744b5301199648b4022100d0de596f597a8f10608f4f0c9a3eaf68ea2152a9ed23f9d3ef3e0d3cde5dd7ff:922c64590222798bb761d5b6d8e72950