mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
7eb6603e77
add two recon modules detecting anon-by-design service registries that leak the internal service map: - eureka-registry-exposure (medium): probes /eureka/apps and matches the registry envelope markers apps__hashcode and versions__delta (the EurekaJacksonCodec formats them with a default '_' -> '__' replacement, so they appear verbatim in both the xml and json forms); eureka has no auth, so an open registry discloses every instance's internal hostname, ip and ports and accepts rogue registrations, while a spring-security-secured eureka returns 401; extracts the first instance ip from either form - spring-boot-admin-exposure (medium): probes /instances and matches the registration/healthUrl/statusInfo shape; the codecentric server ships no security, so an open one discloses every registered app's internal management and health urls (a pivot to their actuators), while a secured one returns 401 or redirects to login; extracts the first internal health url both modules carry hard-test coverage: eureka is proven on both its xml and json forms, with an N-1 trap (an apps__hashcode-less envelope stays quiet) and a prose trap (a page that merely mentions the word applications stays quiet); sba has an N-1 statusInfo trap; both have 401 secured-instance cases and cross false-positive guards both ways.
39 lines
910 B
YAML
39 lines
910 B
YAML
# Netflix Eureka Service Registry Exposure Detection Module
|
|
|
|
id: eureka-registry-exposure
|
|
info:
|
|
name: Netflix Eureka Service Registry Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects an exposed Netflix Eureka registry that leaks every service's internal hostname, ip and port and accepts rogue registrations
|
|
tags: [eureka, netflix, spring-cloud, service-registry, discovery, information-disclosure, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/eureka/apps"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "apps__hashcode"
|
|
- "versions__delta"
|
|
- "applications"
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: eureka_instance_ip
|
|
part: body
|
|
regex:
|
|
- '<ipAddr>([^<]+)</ipAddr>'
|
|
- '"ipAddr"\s*:\s*"([^"]+)"'
|
|
group: 1
|