AWS OpenSearch Login - Detect

ID: aws-opensearch-login

Severity: info

Author: Higor Melgaço (eremit4)

Tags: panel,opensearch,aws,amazon

Description

AWS OpenSearch login page was detected.

YAML Source

id: aws-opensearch-login

info:
  name: AWS OpenSearch Login - Detect
  author: Higor Melgaço (eremit4)
  severity: info
  description: AWS OpenSearch login page was detected.
  reference:
    - https://aws.amazon.com/pt/blogs/opensource/introducing-opensearch/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
    cpe: cpe:2.3:a:amazon:opensearch:*:*:*:*:maven:*:*:*
  metadata:
    max-request: 1
    vendor: amazon
    product: opensearch
  tags: panel,opensearch,aws,amazon

http:
  - method: GET
    path:
      - '{{BaseURL}}/_dashboards/app/login'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "Please login to OpenSearch Dashboards"
# digest: 4b0a00483046022100f52a088efbdaa8c8a48953311291085e781b393b895246f5d81336d01ff3d314022100da337dcb804379136b080bdf631c558b32e2864dfd862fb6623e76b1d39bbd44:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/exposed-panels/aws-opensearch-login.yaml"

View on Github