Create pritunl-unfinished-install.yaml

2026-11-07 08:36:19 -10:00 · 2026-01-14 09:03:01 +09:00
1 changed files with 34 additions and 0 deletions
@@ -0,0 +1,34 @@
+id: pritunl-unfinished-install
+
+info:
+  name: Pritunl - Unfinished Installation
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    Detected Pritunl VPN server with an unfinished installation, potentially allowing unauthorized setup and configuration takeover.
+  reference:
+    - https://pritunl.com/
+    - https://docs.pritunl.com/docs/configuration-5
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
+    cvss-score: 7.4
+    cwe-id: CWE-284
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.title:"Pritunl Database Setup"
+    fofa-query: title="Pritunl Database Setup"
+  tags: pritunl,vpn,install,exposure,misconfig
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/setup"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "pritunl", "MongoDB URI", "Setup Key")'
+          - 'contains_any(body, "sudo pritunl setup-key", "database setup", "Enterprise VPN Server")'
+        condition: and