id: kubernetes-kustomization-disclosure info: name: Kubernetes Kustomize Configuration - Detect author: dhiyaneshDk severity: medium description: Kubernetes Kustomize configuration was detected. reference: - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/kubernetes-kustomization-disclosure.json classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cwe-id: CWE-200 tags: exposure,config,kubernetes requests: - method: GET path: - "{{BaseURL}}/kustomization.yml" matchers-condition: and matchers: - type: word part: body condition: or words: - "apiVersion:" - "resources:" - "namespace:" - "commonLabels:" - "Kustomization" - type: dsl dsl: - "contains(tolower(all_headers), 'application/yaml')" - type: status status: - 200 # Enhanced by md on 2023/02/09