java-melody-exposed: JavaMelody Monitoring Exposed

2025-08-01 Java Melody PoC Public

Description

JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to "View http sessions". This can be used by an attacker to steal a user's session.

PoC

id: java-melody-exposed

info:
  name: JavaMelody Monitoring Exposed
  author: dhiyaneshDK,thomas_from_offensity
  severity: medium
  description: JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to "View http sessions". This can be used by an attacker to steal a user's session.
  reference:
    - https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
    - https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
  metadata:
    max-request: 2
  tags: config,java,javamelody,misconfig,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/monitoring'
      - '{{BaseURL}}/..%3B/monitoring'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Monitoring JavaMelody on'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022027051ca89a25a36852ac6a2075b7b44edd781a53126517942bbff69f77e6eb620221008e2e770448d0e3acf9806ff836bf9c2606a24a77e8882110d137e832acc84ae8:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/java-melody-exposed.yaml

References

Related Vulnerabilities