id: jolokia-heap-info-disclosure
info:
name: Jolokia Java Heap Information Disclosure
author: milo2012
severity: info
tags: jolokia,disclosure,java
metadata:
max-request: 1
http:
- raw:
- |
POST /jolokia/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
{
"type":"EXEC",
"mbean":"com.sun.management:type=HotSpotDiagnostic",
"operation":"dumpHeap",
"arguments":[
"/tmp1234/test1.hprof",
0
]
}
matchers:
- type: word
words:
- 'stacktrace":"java.io.IOException: No such file or directory'
part: body
