mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
6e022d56d9
add recon modules for self-hosted agent builders and compute orchestration. ray exposes an unauthenticated compute dashboard whose job api allows code execution, skypilot exposes an open cloud and kubernetes control plane when basic auth is disabled, dify flags a console that allows open registration, and langflow fingerprints a reachable instance over its public version api.
52 lines
1.2 KiB
YAML
52 lines
1.2 KiB
YAML
# SkyPilot API Server Exposure Detection Module
|
|
|
|
id: skypilot-api-exposure
|
|
info:
|
|
name: SkyPilot API Server Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects an open SkyPilot api server with basic auth disabled; it provisions and controls cloud and kubernetes clusters and holds the cloud credentials, so an unauthenticated server allows job submission and credential access. The health endpoint is served even when auth is enabled, so the module requires basic_auth_enabled to be false to confirm the server is open
|
|
tags: [skypilot, ai, ml, compute, orchestration, exposure, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/api/health"
|
|
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"version_on_disk\""
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"commit\""
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"basic_auth_enabled"\s*:\s*false'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: skypilot_version
|
|
part: body
|
|
regex:
|
|
- '"version"\s*:\s*"([^"]+)"'
|
|
group: 1
|
|
|
|
- type: regex
|
|
name: skypilot_basic_auth
|
|
part: body
|
|
regex:
|
|
- '"basic_auth_enabled"\s*:\s*(true|false)'
|
|
group: 1
|