id: seafile-public-registration

info:
  name: Seafile - Public Registration Enabled
  author: theamanrawat
  severity: info
  description: |
    Detected public user registration is enabled on a Seafile instance.
  reference:
    - https://forum.seafile.com/t/seafile-disable-email-registration-for-users/4957
  metadata:
    verified: true
    max-requests: 1
    shodan-query: http.title:"Seafile"
    fofa-query: title="Seafile"
  tags: misconfig,seafile,registration,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/accounts/register/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "id_email", "id_password1", "csrfmiddlewaretoken", "seafile-ui.css", "SEAFILE_GLOBAL")'
        condition: and
# digest: 4a0a004730450221008ea57c7e3e5ead8af65b19beaf960df789d96f450b2b7268dd5518eb0dcc35700220054f7211f31119eb1002772dcece07668728aa0a7bb00a9edc6eefc3ee4979a4:922c64590222798bb761d5b6d8e72950