victoriametrics-vmagent-api-exposure: VictoriaMetrics vmagent - Unauthenticated Targets Exposure

id: victoriametrics-vmagent-api-exposure

info:
  name: VictoriaMetrics vmagent - Unauthenticated Targets Exposure
  author: RootKaito
  severity: low
  description: |
    VictoriaMetrics vmagent targets endpoint is exposed without authentication, leaking internal service inventory and scrape configuration.
  reference:
    - https://docs.victoriametrics.com/victoriametrics/vmagent/
  classification:
    cpe: cpe:2.3:a:victoriametrics:victoriametrics:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: victoriametrics
    product: vmagent
  tags: exposure,victoriametrics,vmagent,unauth,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/targets"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"activeTargets"'

      - type: word
        part: header
        words:
          - "X-Server-Hostname"

      - type: status
        status:
          - 200

    extractors:
      - type: json
        name: active_targets
        json:
          - ".data.activeTargets"
# digest: 4a0a0047304502210098d6ff43da04dcfcfa78252fa9b1eb67cb2b34b642af4faa1ecd80c523035519022010642aae753734ccffce04aa4094e7a59dffbc408b2b02ebb17b06970227928e:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.