diff --git a/other/supportForOtherContentTypesThanJson.bcheck b/other/supportForOtherContentTypesThanJson.bcheck index 999652c..bdeb7d2 100644 --- a/other/supportForOtherContentTypesThanJson.bcheck +++ b/other/supportForOtherContentTypesThanJson.bcheck @@ -1,31 +1,33 @@ -metadata: - language: v2-beta - name: "Support for other content types than json detected" - description: "Check if an endpoint, accepting json data, support other interesting content types." +metadata: + language: v2-beta + name: "Support for other content types than json detected" + description: "Check if an endpoint, accepting json data, support other interesting content types." author: "Dominique Righetto" - tags: "active" - -run for each: - # Interesting content types that can bring new attacks vectors - content_type = "application/xml", "application/yaml" - -# The check only trigger for request containing a header "Content-Type" set to "application/json". -# Sources: -# https://portswigger.net/web-security/xxe -# https://portswigger.net/web-security/ssrf -# https://www.sourcery.ai/vulnerabilities/python-pyyaml-unsafe-load-rce -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/415 -given path then - if {base.request.headers} matches "(?i)Content-Type:\s+application\/json" then + tags: "active" + +run for each: + # Interesting content types that can bring new attacks vectors + content_type = "application/xml", "application/yaml" + +# The check only trigger for request containing a header "Content-Type" set to "application/json". +# Sources: +# https://portswigger.net/web-security/xxe +# https://portswigger.net/web-security/ssrf +# https://www.sourcery.ai/vulnerabilities/python-pyyaml-unsafe-load-rce +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/415 +given path then + if {base.request.headers} matches "(?i)Content-Type:\s+application\/json" then send request called checkSupport: replacing headers: - "Content-Type": `{content_type}` - - if not( {checkSupport.response.status_code} is "415" ) then + "Content-Type": `{content_type}` + # Raise attention point in case of 2xx or 5xx response codes + # 2xx: Successful responses => Is not expected as normally a 415 is returned + # 5xx: Server error responses => The request caused an issue on the server side so is not expected + if {checkSupport.response.status_code} matches "(2|5)[0-9]{2}" then report issue: severity: info confidence: firm detail: `Endpoint support other content type than json: {content_type}.` remediation: "Add a constraint on the endpoint to specify that only json content type is supported." - end if - end if + end if + end if