misc updates

misconfiguration/springboot/springboot-env.yaml

@@ -16,11 +16,9 @@ requests:
       - type: word
         part: body
         words:
-          - "JAVA_HOME"
-          - "sping.config.location"
-          - "spring.application.name"
+          - "applicationConfig"
           - "local.server.port"
-        condition: or
+        condition: and
       - type: status
         status:
           - 200

misconfiguration/springboot/springboot-httptrace.yaml

@@ -0,0 +1,34 @@
+id: springboot-httptrace
+
+info:
+  name: Detect Springboot httptrace
+  author: that_juan_ & dwisiswant0 & wdahlenb
+  severity: low
+  description: View recent HTTP requests and responses
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/actuator/httptrace"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"traces"'
+          - '"timestamp"'
+          - '"principal"'
+          - '"session"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "application/json"
+          - "application/vnd.spring-boot.actuator"
+          - "application/vnd.spring-boot.actuator.v1+json"
+        condition: or
+        part: header

misconfiguration/springboot/springboot-loggers.yaml

@@ -17,8 +17,8 @@ requests:
         part: body
         words:
           - '"loggers"'
-          - '"profiles":'
-        condition: or
+          - '"levels"'
+        condition: and
 
       - type: status
         status:

misconfiguration/springboot/springboot-trace.yaml

@@ -10,22 +10,21 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/trace"
-      - "{{BaseURL}}/actuator/trace"
-      - "{{BaseURL}}/httptrace"
-      - "{{BaseURL}}/actuator/httptrace"
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - "traces"
-          - "response"
-          - "request"
-          - "principal"
-        condition: or
+          - '"timestamp"'
+          - '"info"'
+          - '"method"'
+          - '"path"'
+        condition: and
+
       - type: status
         status:
           - 200
+
       - type: word
         words:
           - "application/json"