nuclei-templates/http/misconfiguration/kubernetes/kube-state-metrics.yaml

31 lines
752 B
YAML
Raw Normal View History

2023-03-06 06:40:51 +00:00
id: kube-state-metrics
2023-03-05 17:43:31 +00:00
info:
2023-03-06 06:40:51 +00:00
name: Kube State Metrics Exposure
2023-03-05 17:43:31 +00:00
author: ja1sh
severity: low
description: |
An attacker can detect the public instance of a Kube-State-Metrics metrics. The Kubernetes API server exposes data about the count, health, and availability of pods, nodes, and other Kubernetes objects.
metadata:
verified: "true"
shodan-query: title:Kube-state-metrics
2023-03-06 06:40:51 +00:00
tags: misconfig,exposure,kube-state-metrics,k8s,kubernetes
2023-03-05 17:43:31 +00:00
http:
2023-03-05 17:43:31 +00:00
- method: GET
path:
2023-03-06 06:40:51 +00:00
- "{{BaseURL}}/metrics"
2023-03-05 17:43:31 +00:00
matchers-condition: and
matchers:
- type: word
part: body
words:
2023-03-06 06:40:51 +00:00
- kube-state-metrics
- go_goroutines
condition: and
2023-03-05 17:43:31 +00:00
- type: status
status:
- 200