id: exposed-service-now

info:
  name: ITMS-Misconfigured
  author: dhiyaneshDK
  severity: info
  description: Detection of misconfigured ServiceNow ITSM instances.
  reference:
    - https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
    - https://github.com/leo-hildegarde/SnowDownKB/
  metadata:
    max-request: 1
  tags: misconfig,servicenow

http:
  - method: GET
    path:
      - "{{BaseURL}}/kb_view_customer.do?sysparm_article=KB00xxxx"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Unfortunately the article you are looking for could not be found.'
        part: body

      - type: status
        status:
          - 200
# digest: 490a00463044022004313dd4beba4cf9cba73e0ec8815b574a7b6992a34c0dcc849994e0b8511ad30220358ad7166cb3b776048322db5d621ab7bbada5ccf3bdcfdb4214b66ae0a19d6b:922c64590222798bb761d5b6d8e72950