Create hikivision-env.yaml

http/misconfiguration/hikivision-env.yaml

@@ -0,0 +1,55 @@
+id: hikivision-env
+
+info:
+  name: Hikvision Springboot Env Actuator - Detect
+  author: SleepingBag945
+  severity: high
+  description: |
+    The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks
+  reference:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HiKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20env%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
+    - https://peiqi.wgpsec.org/wiki/iot/HIKVISION/HiKVISION%20综合安防管理平台%20env%20信息泄漏漏洞.html
+  metadata:
+    shodan-query: app="HIKVISION-综合安防管理平台"
+    verified: true
+  tags: misconfig,hikivision,springboot
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/artemis/env"
+      - "{{BaseURL}}/artemis-portal/artemis/env"
+      - "{{BaseURL}}/artemis/actuator/env"
+      - "{{BaseURL}}/artemis;/env;"
+      - "{{BaseURL}}/artemis/1/..;/env"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "applicationConfig"
+          - "activeProfiles"
+        condition: or
+
+      - type: word
+        part: body
+        words:
+          - "server.port"
+          - "local.server.port"
+        condition: or
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+          - "application/vnd.spring-boot.actuator"
+          - "application/vnd.spring-boot.actuator.v1+json"
+          - "application/vnd.spring-boot.actuator.v2+json"
+          - "application/vnd.spring-boot.actuator.v3+json"
+        condition: or
+
+      - type: status
+        status:
+          - 200