id: exposed-service-now

info:
  name: ITMS-Misconfigured
  author: dhiyaneshDK
  severity: info
  description: Detection of misconfigured ServiceNow ITSM instances.
  reference:
    - https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
    - https://github.com/leo-hildegarde/SnowDownKB/
  metadata:
    max-request: 1
  tags: misconfig,servicenow,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/kb_view_customer.do?sysparm_article=KB00xxxx"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Unfortunately the article you are looking for could not be found.'
        part: body

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100db262c96e35d6595868ff0ba0e9263d5d3ace55466df99c69f6be516ccf577ec022100f99bc42511dbf8b5df156778244626f588267c1bddaf4924ef52404ddd7bf9b2:922c64590222798bb761d5b6d8e72950