Jaeger UI

ID: jaeger-ui-dashboard

Severity: low

Author: dhiyaneshDK,righettod

Tags: misconfig

Description

Jaeger UI dashboard is exposed.

YAML Source

id: jaeger-ui-dashboard

info:
  name: Jaeger UI
  author: dhiyaneshDK,righettod
  severity: low
  description: Jaeger UI dashboard is exposed.
  reference:
    - https://www.jaegertracing.io/
  classification:
    cpe: cpe:2.3:a:jaegertracing:jaeger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jaegertracing
    product: jaeger_ui
    shodan-query: http.title:"Jaeger UI"
  tags: misconfig

http:
  - method: GET
    path:
      - '{{BaseURL}}/search'
      - '{{BaseURL}}/api/services'

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "<title>jaeger ui", "jaeger_version", "jaeger_config_js", "jaeger-ui-root", "jaeger-query")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '(?i)"gitVersion":\s*"([a-z0-9.]+)"'
# digest: 4a0a004730450220630da1c7b71ffe01268e80c11db944f78165faf0b01dafc613d944088adec83b022100be3efc188bd29c22304214ed3d7b43bcad1eb7dc6963aa5b2b12f473a2efa932:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/misconfiguration/jaeger-ui-dashboard.yaml"

View on Github