id: azuracast-installer

info:
  name: AzuraCast - Unfinished Installation
  author: DhiyaneshDk
  severity: high
  description: |
    Detected exposed AzuraCast setup wizard that allows unauthorized superuser account creation.An unfinished AzuraCast installation exposes setup endpoints that enable attackers to create
    administrator accounts and gain full control of the application.
  reference:
    - https://github.com/AzuraCast/AzuraCast
    - https://docs.azuracast.com/en/getting-started/installation
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Set Up AzuraCast"
  tags: misconfig,azuracast,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/register"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Set Up AzuraCast"
          - "SetupRegister"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fb7b808c1937d346b8cd835c075a37f5080fd29313411979f56daf5e50b26c14022031ce73725abd59d31ead26cf4e43ce0d1e39b7961ab5d61bb71e7462a779dca4:922c64590222798bb761d5b6d8e72950