id: manage-cabinet-register

info:
  name: Manage Cabinet Register - Exposed
  author: noel
  severity: low
  description: |
   The path to the Cabinet Storage is omniapp/pages/cabinet/managecabinet.jsf?Action=1. If exposed, it gives an attacker insight into information such as Storage Volume Name, Cabinet Name, it's alias, Deployed AppServer IP Address and Port
  reference:
    - https://www.edms-consultants.com/newgen-rlos/
  metadata:
    verified: true
    shodan-query: html:"omniapp"
    max-request: 1
  tags: misconfig,cabinet,exposure

http:
  - method: GET
    path:
      - '{{BaseURL}}/omniapp/pages/cabinet/managecabinet.jsf?Action=1'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Manage Cabinet [Register Cabinet]'

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008f55981e74473c7eaa749359af09f43da24883de9fb1ad8c62181690ce6b055d022032d33ecdff53df2199b73c44dfa18d968a7db1aa644a2226f41a6cc59d7f421a:922c64590222798bb761d5b6d8e72950