nuclei-templates/http/misconfiguration/hikivision-env.yaml

id: hikivision-env

info:
  name: Hikvision Springboot Env Actuator - Detect
  author: SleepingBag945
  severity: high
  description: |
    The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HiKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20env%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
    - https://peiqi.wgpsec.org/wiki/iot/HIKVISION/HiKVISION%20综合安防管理平台%20env%20信息泄漏漏洞.html
  metadata:
    verified: true
    max-request: 5
    shodan-query: app="HIKVISION-综合安防管理平台"
  tags: misconfig,hikivision,springboot,env

http:
  - method: GET
    path:
      - "{{BaseURL}}/artemis/env"
      - "{{BaseURL}}/artemis-portal/artemis/env"
      - "{{BaseURL}}/artemis/actuator/env"
      - "{{BaseURL}}/artemis;/env;"
      - "{{BaseURL}}/artemis/1/..;/env"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "applicationConfig"
          - "activeProfiles"
        condition: or

      - type: word
        part: body
        words:
          - "server.port"
          - "local.server.port"
        condition: or

      - type: word
        part: header
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
        condition: or

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100effc47a075247114653ad921736cba15ecffd8c87f57d94f8ccaa224c6e36c5b022100cf025d5269ad1da196c4185a7d7632c6b4870893ac9484de57051d13d7d67ece:922c64590222798bb761d5b6d8e72950