id: jolokia-heap-info-disclosure

info:
  name: Jolokia Java Heap Information Disclosure
  author: milo2012
  severity: info
  tags: jolokia,disclosure,java
  metadata:
    max-request: 1

http:
  - raw:
      - |
        POST /jolokia/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        {
           "type":"EXEC",
           "mbean":"com.sun.management:type=HotSpotDiagnostic",
           "operation":"dumpHeap",
           "arguments":[
              "/tmp1234/test1.hprof",
              0
           ]
        }

    matchers:
      - type: word
        words:
          - 'stacktrace":"java.io.IOException: No such file or directory'
        part: body