mirror of
https://github.com/lunchcat/sif.git
synced 2026-08-02 00:37:38 -07:00
TigahandGitHub
abcc22de38
add recon modules for unauthenticated rag/search apps that leak config or health without a key: perplexica, verba, onyx, and fastgpt.
45 lines
1.1 KiB
YAML
45 lines
1.1 KiB
YAML
# Verba RAG Health Exposure Detection Module
|
|
|
|
id: verba-health-exposure
|
|
info:
|
|
name: Verba Health Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an exposed Verba rag application; its health endpoint is intentionally exempt from the optional auth and, in the default Local mode, embeds the configured Weaviate cluster url and api key in cleartext, leaking the backend vector-database credentials. Fires only when a backend url is actually populated in the response
|
|
tags: [verba, weaviate, llm, ai, rag, vector, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/api/health"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"WEAVIATE_API_KEY_VERBA\""
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"WEAVIATE_URL_VERBA"\s*:\s*"[^"]+'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"default_deployment\""
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: verba_weaviate_url
|
|
part: body
|
|
regex:
|
|
- '"WEAVIATE_URL_VERBA"\s*:\s*"([^"]+)"'
|
|
group: 1
|