Temporal Web UI - Unauthenticated Access

ID: unauth-temporal-web-ui

Severity: high

Author: ggranjus

Tags: misconfig,temporal,unauth

Description

Temporal Web UI was able to be accessed because no authentication was required

YAML Source

id: unauth-temporal-web-ui

info:
  name: Temporal Web UI - Unauthenticated Access
  author: ggranjus
  severity: high
  description: |
    Temporal Web UI was able to be accessed because no authentication was required
  reference:
    - https://docs.temporal.io/web-ui
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
    cpe: cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    shodan-query: http.favicon.hash:557327884
    product: temporal
    vendor: temporal
  tags: misconfig,temporal,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/favicon.ico"
      - "{{BaseURL}}/api/v1/namespaces/default/workflows?query="

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200 && (\"44c856843ce2631b1d6968ac11fa9ec4\" == md5(body_1))"

      - type: dsl
        dsl:
          - "contains(body_2, 'nextPageToken') && status_code_2 == 200"
          - "contains(body_2, 'Namespace default is not found.') && status_code_2 == 404"
        condition: or
# digest: 490a004630440220469a2f33d8aeb8ad5bcb00b732c20514551086ebe01c2a16a3d094d8b230bd53022021fae9775251e51a379df977317de47de31b2046780684e3e948938105c0449e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/misconfiguration/unauth-temporal-web-ui.yaml"

View on Github