id: roundcube-installer-exposure

info:
  name: Roundcube Webmail Installer - Exposure
  author: theamanrawat
  severity: high
  description: |
    Detects exposure of the Roundcube Webmail installer interface. Public access to this installer may allow attackers to reconfigure the webmail application, potentially leading to email account compromise or the disclosure of sensitive configuration details.
  reference:
    - https://roundcube.net/
    - https://github.com/roundcube/roundcubemail/wiki/Installation
  metadata:
    verified: true
    max-request: 2
  tags: roundcube,webmail,installer,config,misconfig,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/installer/"
      - "{{BaseURL}}/installer/index.php?_step=2"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Roundcube Webmail Installer", "wiki/Installation", "General configuration")'
        condition: and
# digest: 4a0a0047304502206e0489078982f908a384c1e6305fdf87b0ec9fbd32d47978ebe2cab1d00f70c3022100cf32aab13a6f0772dc2a159336708585105dc54b7f86bf5a769720b6370b0a2b:922c64590222798bb761d5b6d8e72950