CraftCMS Debug Methods Exposed Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Detected CraftCMS with devMode enabled, which exposed the Yii2 debug toolbar and sensitive information."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': 'CraftCMS Debug Methods Exposed Detection',
        'description': 'Detected CraftCMS with devMode enabled, which exposed the Yii2 debug toolbar and sensitive information. This misconfiguration could have leaked database queries, session data, cookies, stack traces, CSRF tokens, and internal application details to unauthenticated users.',
        'author': ['KittySploit Team'],
        'severity': 'medium',
        'tags': ['web', 'scanner', 'misconfiguration', 'craftcms', 'debug', 'exposure', 'yii2'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 3,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': ['auxiliary/scanner/http/login_page_detector'],
            },
        },
        'references': [
            'https://craftcms.com/docs/5.x/system/config.html#devmode',
            'https://www.acunetix.com/vulnerabilities/web/craft-cms-development-mode-enabled/',
        ],
    }

    def run(self):
        for path in ('/actions/debug/default/index', '/actions/debug/default/toolbar', '/actions/debug/default/view'):
            r = self.http_request(method="GET", path=path, allow_redirects=False)
            if not r or r.status_code != 200:
                continue
            body = r.text or ""
            headers = "\n".join(f"{k}: {v}" for k, v in r.headers.items())
            body_any = ('Yii Debugger', 'yii-debug-toolbar', 'Available Debug Data', 'cpresources',)
            header_any = ('Craft CMS',)
            if (any(m in body for m in body_any)) and (any(m in headers for m in header_any)):
                self.set_info(
                    severity='medium',
                    reason="CraftCMS Debug Methods Exposed detected",
                    path=path,
                )
                return True
        return False