mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
6e022d56d9
add recon modules for self-hosted agent builders and compute orchestration. ray exposes an unauthenticated compute dashboard whose job api allows code execution, skypilot exposes an open cloud and kubernetes control plane when basic auth is disabled, dify flags a console that allows open registration, and langflow fingerprints a reachable instance over its public version api.
50 lines
1.0 KiB
YAML
50 lines
1.0 KiB
YAML
# Dify Console Exposure Detection Module
|
|
|
|
id: dify-console-exposure
|
|
info:
|
|
name: Dify Console Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects a Dify console with open registration enabled; its unauthenticated system-features endpoint reports is_allow_register true, so anyone can create an account on the llm app platform
|
|
tags: [dify, llm, ai, agent, platform, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/console/api/system-features"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"sso_enforced_for_signin\""
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"enable_email_password_login\""
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"is_allow_create_workspace\""
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"is_allow_register"\s*:\s*true'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: dify_allow_register
|
|
part: body
|
|
regex:
|
|
- '"is_allow_register"\s*:\s*(true|false)'
|
|
group: 1
|