Update h2o-dashboard.yaml

patch-1
Ritik Chaddha 2023-12-21 12:49:50 +05:30 committed by GitHub
parent 9d6f076894
commit ab9015b522
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 7 deletions

View File

@ -1,15 +1,15 @@
id: h2o-dashboard
info:
name: H2O Dashboard Exposure
name: H2O Dashboard - Exposure
author: byt3bl33d3r
severity: high
description: |
H2o dashboard by default has no authentication and can lead to RCE on the host.
metadata:
shodan-query: title:"H2O Flow"
verified: true
max-request: 1
verified: true
shodan-query: title:"H2O Flow"
tags: misconfig,exposure,h2o,ml,unauth
http:
@ -18,17 +18,14 @@ http:
- "{{BaseURL}}"
redirects: true
max-redirects: 1
max-redirects: 2
matchers-condition: and
matchers:
- type: word
part: header
words:
- "X-H2o-Build-Project-Version"
- "X-H2o-Cluster-Good"
- "X-H2o-Cluster-Id"
- "X-H2o-Rest-Api-Version-Max"
condition: and
- type: word