id: google-service-info-plist

info:
  name: GoogleService-Info.plist - Detect
  author: cyberguy-somnath
  severity: info
  description: |
    The GoogleService-Info.plist file contains sensitive information about the Firebase project, including the Google App ID, Project ID, Client ID, Client Secret, and Reversed Client ID. This file is used to authenticate the Firebase SDK in iOS applications.
  remediation: |
    Remove the GoogleService-Info.plist file from the web root and restrict public access.
  reference:
    - https://firebase.google.com/docs/ios/setup
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: config,exposure,firebase,ios

http:
  - method: GET
    path:
      - "{{BaseURL}}/GoogleService-Info.plist"

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/octet-stream")'
          - 'contains_all(body, "<key>GOOGLE_APP_ID</key>", "<key>PROJECT_ID</key>", "<key>API_KEY</key>")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100865c73056e8264d1fd6357b09d99ac8a284e87da96701b9e131f847e8a46968a022100fee68847f9ddec6733d03844705deb80670b25f2a7594626dad06874bdd027ba:922c64590222798bb761d5b6d8e72950