From 52a133fd62d21d67444648fa76f564a5b879981a Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO Date: Fri, 23 Jan 2026 08:18:33 +0100 Subject: [PATCH 1/2] Add files via upload --- ...supportForOtherContentTypesThanJson.bcheck | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 other/supportForOtherContentTypesThanJson.bcheck diff --git a/other/supportForOtherContentTypesThanJson.bcheck b/other/supportForOtherContentTypesThanJson.bcheck new file mode 100644 index 0000000..999652c --- /dev/null +++ b/other/supportForOtherContentTypesThanJson.bcheck @@ -0,0 +1,31 @@ +metadata: + language: v2-beta + name: "Support for other content types than json detected" + description: "Check if an endpoint, accepting json data, support other interesting content types." + author: "Dominique Righetto" + tags: "active" + +run for each: + # Interesting content types that can bring new attacks vectors + content_type = "application/xml", "application/yaml" + +# The check only trigger for request containing a header "Content-Type" set to "application/json". +# Sources: +# https://portswigger.net/web-security/xxe +# https://portswigger.net/web-security/ssrf +# https://www.sourcery.ai/vulnerabilities/python-pyyaml-unsafe-load-rce +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/415 +given path then + if {base.request.headers} matches "(?i)Content-Type:\s+application\/json" then + send request called checkSupport: + replacing headers: + "Content-Type": `{content_type}` + + if not( {checkSupport.response.status_code} is "415" ) then + report issue: + severity: info + confidence: firm + detail: `Endpoint support other content type than json: {content_type}.` + remediation: "Add a constraint on the endpoint to specify that only json content type is supported." + end if + end if From b53ad4cc48e86a7a6a9f38f3801985b44374d0fe Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO Date: Mon, 6 Jul 2026 12:00:04 +0200 Subject: [PATCH 2/2] Refactor content type check logic in bcheck file Updated the logic to check for response codes and added comments for clarity. --- ...supportForOtherContentTypesThanJson.bcheck | 48 ++++++++++--------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/other/supportForOtherContentTypesThanJson.bcheck b/other/supportForOtherContentTypesThanJson.bcheck index 999652c..bdeb7d2 100644 --- a/other/supportForOtherContentTypesThanJson.bcheck +++ b/other/supportForOtherContentTypesThanJson.bcheck @@ -1,31 +1,33 @@ -metadata: - language: v2-beta - name: "Support for other content types than json detected" - description: "Check if an endpoint, accepting json data, support other interesting content types." +metadata: + language: v2-beta + name: "Support for other content types than json detected" + description: "Check if an endpoint, accepting json data, support other interesting content types." author: "Dominique Righetto" - tags: "active" - -run for each: - # Interesting content types that can bring new attacks vectors - content_type = "application/xml", "application/yaml" - -# The check only trigger for request containing a header "Content-Type" set to "application/json". -# Sources: -# https://portswigger.net/web-security/xxe -# https://portswigger.net/web-security/ssrf -# https://www.sourcery.ai/vulnerabilities/python-pyyaml-unsafe-load-rce -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/415 -given path then - if {base.request.headers} matches "(?i)Content-Type:\s+application\/json" then + tags: "active" + +run for each: + # Interesting content types that can bring new attacks vectors + content_type = "application/xml", "application/yaml" + +# The check only trigger for request containing a header "Content-Type" set to "application/json". +# Sources: +# https://portswigger.net/web-security/xxe +# https://portswigger.net/web-security/ssrf +# https://www.sourcery.ai/vulnerabilities/python-pyyaml-unsafe-load-rce +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/415 +given path then + if {base.request.headers} matches "(?i)Content-Type:\s+application\/json" then send request called checkSupport: replacing headers: - "Content-Type": `{content_type}` - - if not( {checkSupport.response.status_code} is "415" ) then + "Content-Type": `{content_type}` + # Raise attention point in case of 2xx or 5xx response codes + # 2xx: Successful responses => Is not expected as normally a 415 is returned + # 5xx: Server error responses => The request caused an issue on the server side so is not expected + if {checkSupport.response.status_code} matches "(2|5)[0-9]{2}" then report issue: severity: info confidence: firm detail: `Endpoint support other content type than json: {content_type}.` remediation: "Add a constraint on the endpoint to specify that only json content type is supported." - end if - end if + end if + end if