daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update prometheus-targets-endpoint.yaml

patch-1
Prince Chaddha 2021-10-19 22:25:44 +05:30 committed by GitHub
parent 6d13118df6
commit a25a9f3020
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
exposures/configs/prometheus-targets-endpoint.yaml
View File

@ -1,9 +1,9 @@
id: prometheus-targets-endpoint
info:
name: Exposure of sensitive operational information via Prometheus targets API endpoint
name: Prometheus targets API endpoint
author: geeknik
severity: high
severity: info
description: The targets endpoint exposes services belonging to the infrastructure, including their roles and labels. In addition to showing the target machine addresses, the endpoint also exposes metadata labels that are added by the target provider. These labels are intended to contain non-sensitive values, like the name of the server or its description, but various cloud platforms may automatically expose sensitive data in these labels, oftentimes without the developer’s knowledge.
reference: https://jfrog.com/blog/dont-let-prometheus-steal-your-fire/
tags: prometheus,exposure