id: mailpit-app-info-disclosure

info:
  name: Mailpit App - Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    Mailpit exposes the /api/v1/messages endpoint which can leak email metadata or full email content without authentication, leading to information disclosure.
  reference:
    - https://github.com/axllent/mailpit
    - https://mailpit.axllent.org/docs/api/
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Mailpit"
  tags: mailpit,exposure,disclosure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/messages"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"messages":'
          - '"ID":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100dbddb4f085329212485a42a0abcd4a59f8f086cf8b9582940f9cd0f9e0e881390221008bf6b14c70cb206910c4d030c2c8e98d8f6ea4d343f64df5f86c7a6edf9e78d9:922c64590222798bb761d5b6d8e72950