id: fastcgi-echo

info:
  name: FastCGI Echo Endpoint Script - Detect
  author: powerexploit
  severity: info
  description: |
    FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses.
  remediation: Remove or disable FastCGI module delivered with the Apache httpd server which is incorporated into the Oracle Application Server.FastCGI echo programs (echo and echo2).
  reference:
    - https://www.exploit-db.com/ghdb/183
    - https://www.integrigy.com/oracle-application-server-fastcgi-echo-vulnerability-reports
  classification:
    cpe: cpe:2.3:a:fastcgi:fcgi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fastcgi
    product: fcgi
    google-query: inurl:fcgi-bin/echo
  tags: exposure,logs,oracle,fastcgi,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/fcgi-bin/echo"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>FastCGI echo</title>"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a004630440220521cdd11d28a6e61208c03a551c05222abe0f1bd56103bb54018cf4eeb92504b0220773d5f33969c2d6a0ad1891490ee29bee18cc4fc1d9a314cb90e7ff4c2b7661b:922c64590222798bb761d5b6d8e72950