id: deployment-ini

info:
  name: FTP Deployment Config File - Exposure
  author: Michal Mikolas (nanuqcz)
  severity: medium
  description: |
    Config file for "FTP deployment" utility usually contains server's FTP credentials in plain text.
  remediation: |
    Delete the config file from server & add it to `ignore` section of the deployment file. Or block access to the file using `.htaccess` on the server.
  reference:
    - https://github.com/dg/ftp-deployment
  metadata:
    max-request: 12
    vendor: dg
    product: "ftp-deployment"
  tags: config,exposure,dg

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    payloads:
      paths:
        - "/deployment.ini"
        - "/deploy.ini"
        - "/production.ini"
        - "/prod.ini"
        - "/deployment.production.ini"
        - "/deployment.prod.ini"
        - "/deploy.production.ini"
        - "/deploy.prod.ini"
        - "/server.ini"
        - "/ftp.ini"
        - "/ftps.ini"
        - "/sftp.ini"

    stop-at-first-match: true

    matchers:
      - type: regex
        regex:
          - "^remote\\s*=\\s*"
          - '^\[(.*?)\]$'
        condition: and
# digest: 4a0a004730450220613baf3e382a6bae089ddcc2df862df9d74c8170e0d1ab1ef9f5e652ae830907022100a79c5775c009ca5e9e62b0d4690d1e77ccae1bf50c99d2771b230e097b1e4312:922c64590222798bb761d5b6d8e72950