id: sharepoint-files-disclosure

info:
  name: Microsoft SharePoint Files Disclosure
  author: pussycat0x
  severity: info
  description: |
    Deteted information revealed that Microsoft SharePoint files had been inadvertently disclosed.
  reference:
    - https://sharepointstuff.com/2021/03/30/useful-sharepoint-urls/
    - https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/working-with-folders-and-files-with-rest
  metadata:
    verified: true
    shodan-query: http.title:"SharePoint"
    fofa-query: title="SharePoint"
  tags: sharepoint,microsoft,exposure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/_api/web/roledefinitions"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'BasePermissions','schemas.microsoft.com','_api/Web/')"
        condition: and
# digest: 4b0a00483046022100e42901bdb1d74b6391e3ffaa4634d088cb3868455ab0a6bd5b5f11d220ad481c022100de245a909cd90c3777063d9c4b0a25f5a44fde3df0ddc3095f42973f817470fe:922c64590222798bb761d5b6d8e72950