Behat Configuration File Exposure

What is the "Behat Configuration File Exposure?"

The "Behat Configuration File Exposure" module is designed to detect misconfigurations in the Behat configuration file. Behat is a testing framework for behavior-driven development (BDD) in PHP. This module specifically targets the exposure of the Behat configuration file, which can potentially lead to sensitive information being exposed.

This module has a severity level of low.

Impact

If the Behat configuration file is exposed, it may reveal sensitive information such as database credentials, API keys, or other configuration details. This can potentially be exploited by attackers to gain unauthorized access or perform other malicious activities.

How the module works?

The "Behat Configuration File Exposure" module works by sending HTTP requests to specific paths, namely "/behat.yml" and "/behat.yml.dist". It then applies matching conditions to determine if the configuration file is exposed.

The matching conditions for this module are as follows:

- The response body must contain the words "default:", "paths:", and "suites:". - The HTTP response status must be 200.

If both conditions are met, the module will report a vulnerability.

Here is an example of an HTTP request sent by this module:

GET /behat.yml

Please note that this is just one test case that the Vidoc platform can perform using this module.