id: oauth-authorization-server-exposure

info:
  name: Well-Known OAuth Authorization Server Metadata
  author: rxerium
  severity: info
  description: |
    Detects OAuth 2.0 Authorization Server metadata (RFC 8414).
  impact: |
    Presence of this well-known resource can expose implementation details or policies.
  reference:
    - https://www.rfc-editor.org/rfc/rfc8414
  metadata:
    verified: true
    max-request: 1
    google-query: inurl:"/.well-known/oauth-authorization-server"
  tags: well-known,oauth,oidc,security,rfc8414,miscellaneous,misc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/oauth-authorization-server"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "issuer"
          - "authorization_endpoint"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f93f657053946b61f5ee8b7f99c90702cf53921a66263482e157c44fc66d6cc3022071df61b93cad4994e576115f53e8ed3c9c099184331e25ae69d205a3dadfb49b:922c64590222798bb761d5b6d8e72950