mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
19eb3b4292
add a recon module for an unauthenticated prometheus alertmanager: the /api/v2/status endpoint answers without credentials and returns config.original, the full running configuration, which discloses receiver integrations and any embedded credentials such as slack, pagerduty and webhook urls and smtp passwords, along with the build version and cluster peers; an instance behind an authenticating proxy returns 401 and is not flagged.
38 lines
863 B
YAML
38 lines
863 B
YAML
# Prometheus Alertmanager Status Exposure Detection Module
|
|
|
|
id: alertmanager-status-exposure
|
|
info:
|
|
name: Prometheus Alertmanager Status Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an unauthenticated Prometheus Alertmanager whose status api leaks the running config including receiver credentials
|
|
tags: [alertmanager, prometheus, monitoring, alerting, config, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/api/v2/status"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"versionInfo\""
|
|
- "\"config\""
|
|
- "\"cluster\""
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: alertmanager_version
|
|
part: body
|
|
regex:
|
|
- '"versionInfo"\s*:\s*\{[^}]*"version"\s*:\s*"([^"]+)"'
|
|
group: 1
|