mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
7eb6603e77
add two recon modules detecting anon-by-design service registries that leak the internal service map: - eureka-registry-exposure (medium): probes /eureka/apps and matches the registry envelope markers apps__hashcode and versions__delta (the EurekaJacksonCodec formats them with a default '_' -> '__' replacement, so they appear verbatim in both the xml and json forms); eureka has no auth, so an open registry discloses every instance's internal hostname, ip and ports and accepts rogue registrations, while a spring-security-secured eureka returns 401; extracts the first instance ip from either form - spring-boot-admin-exposure (medium): probes /instances and matches the registration/healthUrl/statusInfo shape; the codecentric server ships no security, so an open one discloses every registered app's internal management and health urls (a pivot to their actuators), while a secured one returns 401 or redirects to login; extracts the first internal health url both modules carry hard-test coverage: eureka is proven on both its xml and json forms, with an N-1 trap (an apps__hashcode-less envelope stays quiet) and a prose trap (a page that merely mentions the word applications stays quiet); sba has an N-1 statusInfo trap; both have 401 secured-instance cases and cross false-positive guards both ways.
38 lines
839 B
YAML
38 lines
839 B
YAML
# Spring Boot Admin Exposure Detection Module
|
|
|
|
id: spring-boot-admin-exposure
|
|
info:
|
|
name: Spring Boot Admin Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects an exposed Spring Boot Admin server that leaks every registered app's internal management and health urls and metadata
|
|
tags: [spring-boot-admin, spring, actuator, monitoring, registry, information-disclosure, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/instances"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"registration\""
|
|
- "\"healthUrl\""
|
|
- "\"statusInfo\""
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: sba_health_url
|
|
part: body
|
|
regex:
|
|
- '"healthUrl"\s*:\s*"([^"]+)"'
|
|
group: 1
|