id: odbc-connection-string

info:
  name: ODBC Connection String
  author: DhiyaneshDK
  severity: info
  reference:
    - https://github.com/praetorian-inc/noseyparker/blob/main/crates/noseyparker/data/default/builtin/rules/odbc.yml
    - https://docs.aws.amazon.com/redshift/latest/mgmt/configure-odbc-connection.html
    - https://docs.microsoft.com/en-us/azure/data-explorer/kusto/api/connection-strings/kusto
  classification:
    cwe-id: CWE-540
  metadata:
    verified: true
    max-request: 1
  tags: odbc,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        part: body
        regex:
          - (?i)(?:User|User\sId|UserId|Uid)\s*=\s*([^\s;]{3,100})\s*;[\ \t]*.{0,10}[\ \t]*(?:Password|Pwd)\s*=\s*([^\t\ ;]{3,100})\s*(?:[;]|$)
# digest: 4b0a00483046022100a6cedbf9277ff6d3a8b98795ae10597e8ffe166abc1c18db9e28642f130a19df022100e6a454ce4609d9c54987a32649c2d74f5bdf13b8e68ac3e50f66aaaee4129df5:922c64590222798bb761d5b6d8e72950