id: CVE-2019-11248

info:
  name: exposed_pprof
  author: 0xceeb,ritikchaddha
  severity: high
  description: The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially
    leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium
    severity, but not exposed by the default configuration.
  reference:
    - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
    - http://mmcloughlin.com/posts/your-pprof-is-showing
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2019-11248
    cwe-id: CWE-862
  tags: cve,cve2019,debug

requests:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof/"
      - "{{BaseURL}}/debug/pprof/goroutine?debug=1"

    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Types of profiles available:"
          - "Profile Descriptions"
          - "goroutine profile: total"
        condition: or