nuclei-templates/http/misconfiguration/jupyter-lab-unauth.yaml

42 lines
861 B
YAML

id: unauth-jupyter-lab
info:
name: Jupyter Lab - Unauthenticated Access
author: j4vaovo
severity: critical
description: |
JupyterLab was able to be accessed without authentication.
reference:
- https://paper.seebug.org/2058/
classification:
cvss-score: 10.0
cvss-metrics: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cwe-id: CWE-288
metadata:
shodan-query: http.favicon.hash:450899026
tags: unauth,jupyter,jupyterlab,misconfig
http:
- method: GET
path:
- '{{BaseURL}}/lab/api/settings/'
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"id":'
- '"settings"'
- '"schema":'
condition: and
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 200