Merge pull request #155 from nithisshs/main

[ Pull Request ] For Configs and Exposure related bcheck

other/APIs/couchbase-unauth-apis.bcheck

@@ -0,0 +1,27 @@
+metadata:
+    language: v2-beta
+    name: "Couchbase Buckets Unauthenticated REST API - Detect"
+    description: "Couchbase Buckets REST API without authentication was detected"
+    author: "Nithissh"
+
+run for each:
+    # you could add more values to this list to make the check repeat
+    potential_path =
+        "/pools/default/buckets"
+
+given host then
+    send request called check:
+        method: "GET"
+        path: {potential_path}
+
+    if {check.response.status_code} is "200" 
+            and "couchbase" in {check.response.body} 
+            and "bucket" in {check.response.body} 
+            and "data" in {check.response.body} 
+            and "application/json" in {check.response.headers} then
+        report issue:
+            severity: medium
+            confidence: certain
+            remediation: "Public access should be revoked"
+            detail: `Couchbase bucket publicly exposed on {potential_path}.`
+    end if

other/configs/apache-airflow-config-exposure.bcheck

@@ -0,0 +1,23 @@
+metadata:
+    language: v2-beta
+    name: "Apache Airflow Configuration Page"
+    description: "Apache Airflow configuration page was detected"
+    author: "Nithissh"
+
+run for each:
+    # you could add more values to this list to make the check repeat
+    potential_path =
+        "airflow.cfg"
+
+given host then
+    send request called check:
+        method: "GET"
+        path: {potential_path}
+
+    if "[core]" in {check.response.body} and "[api]" in {check.response.body} then
+        report issue:
+            severity: medium
+            confidence: certain
+            detail: `Apache airflow configuration page found on {potential_path}.`
+            remediation: "Ensure your Apache airflow configuration page are not exposed."
+    end if

other/configs/dockerrun-aws-config-page-exposure.bcheck

@@ -0,0 +1,23 @@
+metadata:
+    language: v2-beta
+    name: "Dockerrun AWS Configuration Page Exposed"
+    description: "Dockerrun AWS configuration page was detected"
+    author: "Nithissh"
+
+run for each:
+    # you could add more values to this list to make the check repeat
+    potential_path =
+        "/Dockerrun.aws.json"
+
+given host then
+    send request called check:
+        method: "GET"
+        path: {potential_path}
+
+    if "AWSEBDockerrunVersion" in {latest.response} and "containerDefinitions" in {latest.response} then
+        report issue:
+            severity: medium
+            confidence: certain
+            detail: `Dockerrun AWS configuration page exposed on {potential_path}.`
+            remediation: "Make sure to disable the configuration page to public"
+    end if