Selenium - Node Exposure

ID: selenium-exposure

Severity: high

Author: w0Tx

Tags: misconfig,selenium,misconfiguration,rce,chromium

Description

Selenium was shown to have an exposed node. If a Selenium node is exposed without any form of authentication, remote command execution could be possible if chromium is configured. By default the port is 4444, still, most of the internet facing are done through reverse proxies.

YAML Source

id: selenium-exposure

info:
  name: Selenium - Node Exposure
  author: w0Tx
  severity: high
  description: |
    Selenium was shown to have an exposed node. If a Selenium node is exposed without any form of authentication, remote command execution could be possible if chromium is configured. By default the port is 4444, still, most of the internet facing are done through reverse proxies.
  reference:
    - https://nutcrackerssecurity.github.io/selenium.html
    - https://labs.detectify.com/2017/10/06/guest-blog-dont-leave-your-grid-wide-open/
  classification:
    cpe: cpe:2.3:a:selenium:selenium:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: selenium
    product: selenium
    shodan-query: "/wd/hub"
  tags: misconfig,selenium,misconfiguration,rce,chromium

http:
  - method: GET
    path:
      - "{{BaseURL}}/wd/hub"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'WebDriverRequest'
          - '<title>WebDriver Hub</title>'
        condition: or

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e558452341017fcd85ef116f1eeaf1fc1bd1433b37ec6bf9984eff22472e3203022100f15a59c06f237aa241d9fe9692008a4aba38696c72bb3d2b90018f69843da7c4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/misconfiguration/selenium-exposure.yaml"

View on Github