Merge pull request #7002 from j4vaovo/patch-6

Create jupyter-lab-unauth.yaml

misconfiguration/jupyter-lab-unauth.yaml

@@ -0,0 +1,41 @@
+id: unauth-jupyter-lab
+
+info:
+  name: Jupyter Lab - Unauthenticated Access
+  author: j4vaovo
+  severity: critical
+  description: |
+    JupyterLab was able to be accessed without authentication.
+  reference:
+    - https://paper.seebug.org/2058/
+  classification:
+    cvss-score: 10.0
+    cvss-metrics: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cwe-id: CWE-288
+  metadata:
+    shodan-query: http.favicon.hash:450899026
+  tags: unauth,jupyter,jupyterlab,misconfig
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/lab/api/settings/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"id":'
+          - '"settings"'
+          - '"schema":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200