nuclei-templates/misconfiguration/prometheus/prometheus-config.yaml

33 lines
976 B
YAML

id: prometheus-config
info:
name: Prometheus config API endpoint
author: geeknik
severity: info
description: The config endpoint returns the loaded Prometheus configuration file. This file also contains addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credentials config configuration field with the placeholder <secret> (although this still leaks the username).
reference: https://jfrog.com/blog/dont-let-prometheus-steal-your-fire/
tags: prometheus,config
requests:
- method: GET
path:
- "{{BaseURL}}/api/v1/status/config"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '"status": "success":'
- '"data":'
- '"yaml":'
condition: and
- type: word
part: header
words:
- 'application/json'