id: cyberark-pvwa-panel

info:
  name: CyberArk Password Vault Web Access - Login Panel
  author: rxerium
  severity: info
  description: |
    CyberArk Password Vault Web Access (PVWA) is the web interface for CyberArk Privileged Access Manager. The PVWA login panel was detected.
  reference:
    - https://www.cyberark.com/
  metadata:
    verified: true
    max-request: 1
    vendor: cyberark
    product: password_vault_web_access
    shodan-query: http.html:"/PasswordVault/"
  tags: panel,cyberark,pvwa,pam

http:
  - method: GET
    path:
      - "{{BaseURL}}/PasswordVault/"

    host-redirects: true
    max-redirects: 3

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<title>Password Vault</title>'
          - '/PasswordVault/v10/assets/cyb-loading-page'
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 200
# digest: 4a0a0047304502204432c40061bf1a7e377fa5a990a875e43e7edbef872d6f04b91e4ce065fe13a7022100e3e79a70a1caebed0946194f68c2cdc69cb9f31ab63119daceef4cb4581b8b3a:922c64590222798bb761d5b6d8e72950