id: java-melody-exposed

info:
  name: JavaMelody Monitoring Exposed
  author: dhiyaneshDK
  severity: medium
  description: JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to “View http sessions”. This can be used by an attacker to steal a user’s session.
  reference: |
    - https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
    - https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
  tags: config,jira,confluence,bamboo,atlassian

requests:
  - method: GET
    path:
      - '{{BaseURL}}/monitoring'
      - '{{BaseURL}}/..%3B/monitoring'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Monitoring JavaMelody on'
      - type: status
        status:
          - 200