From e6029630f4ce169b1026d489d80433161b169cc0 Mon Sep 17 00:00:00 2001 From: Philippe Delteil Date: Fri, 20 Aug 2021 03:08:19 -0400 Subject: [PATCH 1/3] Create springboot-info.yaml --- .../springboot/springboot-info.yaml | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 misconfiguration/springboot/springboot-info.yaml diff --git a/misconfiguration/springboot/springboot-info.yaml b/misconfiguration/springboot/springboot-info.yaml new file mode 100644 index 0000000000..351873602b --- /dev/null +++ b/misconfiguration/springboot/springboot-info.yaml @@ -0,0 +1,35 @@ +id: springboot-info + +info: + name: Detect Springboot Information page + author: philippedelteil + severity: low + description: Displays app name and version information among others values + tags: springboot + +requests: + - method: GET + path: + - "{{BaseURL}}/info" + - "{{BaseURL}}/actuator/info" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"build"' + - '"artifact"' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v2+json" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header From d3552cc6e32e6b9e4c70b642dd59eac4ff28180d Mon Sep 17 00:00:00 2001 From: sandeep Date: Sat, 21 Aug 2021 01:20:10 +0530 Subject: [PATCH 2/3] Update springboot-info.yaml --- misconfiguration/springboot/springboot-info.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/misconfiguration/springboot/springboot-info.yaml b/misconfiguration/springboot/springboot-info.yaml index 351873602b..c863ce09b9 100644 --- a/misconfiguration/springboot/springboot-info.yaml +++ b/misconfiguration/springboot/springboot-info.yaml @@ -12,6 +12,7 @@ requests: path: - "{{BaseURL}}/info" - "{{BaseURL}}/actuator/info" + matchers-condition: and matchers: - type: word From 74871a7412b8a62bc80831779602627789c2d30e Mon Sep 17 00:00:00 2001 From: sandeep Date: Fri, 17 Sep 2021 02:21:49 +0530 Subject: [PATCH 3/3] Update springboot-info.yaml --- misconfiguration/springboot/springboot-info.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misconfiguration/springboot/springboot-info.yaml b/misconfiguration/springboot/springboot-info.yaml index c863ce09b9..c9d77a9f5f 100644 --- a/misconfiguration/springboot/springboot-info.yaml +++ b/misconfiguration/springboot/springboot-info.yaml @@ -3,7 +3,7 @@ id: springboot-info info: name: Detect Springboot Information page author: philippedelteil - severity: low + severity: info description: Displays app name and version information among others values tags: springboot