id: orbeon-forms-exposure

info:
  name: Orbeon Forms Exposure
  author: ritikchaddha
  severity: info
  description: |
    Detects exposed Orbeon Forms interfaces including Form Runner, Form Builder, and Quick Links. Orbeon Forms is a web forms solution that may expose sensitive form data and administrative interfaces if not properly secured.
  reference:
    - https://doc.orbeon.com/
    - https://github.com/orbeon/orbeon-forms
  metadata:
    max-request: 2
    vendor: orbeon
    product: orbeon-forms
    shodan-query: http.favicon.hash:1253194620
  tags: exposure,orbeon,forms,form-runner

http:
  - method: GET
    path:
      - "{{BaseURL}}/orbeon/"
      - "{{BaseURL}}"

    redirects: true
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Orbeon"
          - "home</a>"
          - "Quick Links"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c5178e32f12156a6efcdde7f2ab727df905eccbc8ec3a8e34a538ab33dabaf96022025264b7dd60d05ebf95062ab4e2cb29c73ab9929adfa8b2676782b154722124f:922c64590222798bb761d5b6d8e72950