apache-skywalking-dashboard: Apache SkyWalking - Dashboard

id: apache-skywalking-dashboard

info:
  name: Apache SkyWalking - Dashboard
  author: icarot
  severity: high
  description: |
    Apache SkyWalking server, an APM, Application Performance Monitoring System, exposed the backend monitoring dashboard. An attacker can execute unauthorized operations.
  reference:
    - https://github.com/apache/skywalking
    - https://github.com/apache/skywalking-ui
  metadata:
    max-request: 9
    vendor: apache
    product: skywalking
    shodan-query: title:"Apache SkyWalking"
  tags: apache,skywalking,misconfig,exposure

http:
  - raw:
      - |
        GET /dashboard/list HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'title>Apache SkyWalking'
          - '/css/monaco-editor'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502203c55f2b5abf5d4f94affcc99c6e821867a58a2d01a521611aed3efa00782d8cc0221008ae05ea0ee3ccd20a891155f7da981e4bcfb82c34a6d11d257323da01bac2e89:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.