azure-functions-hostjson-exposure: Azure Functions host.json Configuration Exposure

2026-01-24 Azure Functions host.json PoC Public

Description

Detected exposed Azure Functions host.json configuration files. The exposed metadata revealed sensitive runtime, logging, extension, and infrastructure settings that could aid attackers in understanding the application architecture.

PoC

id: azure-functions-hostjson-exposure

info:
  name: Azure Functions host.json Configuration Exposure
  author: pussycat0x
  severity: medium
  description: |
    Detected exposed Azure Functions host.json configuration files. The exposed metadata revealed sensitive runtime, logging, extension, and infrastructure settings that could aid attackers in understanding the application architecture.
  metadata:
    max-request: 1
    verified: false
  tags: azure,config,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/host.json"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"version"'

      - type: word
        part: body
        words:
          - '"extensionBundle"'
          - '"functionTimeout"'
          - '"logging"'
          - '"extensions"'
          - '"healthMonitor"'
          - '"singleton"'
          - '"concurrency"'
          - '"Microsoft.Azure.Functions.ExtensionBundle"'
        condition: or

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100d03a8629bdfde9c7302dd3ff5d96b1bd728ecb22686ad4174c8998271bc02e34022100a2ad5a1d6d3330e8a03caea4957c2bb4f361ee9518b05881ff9a431ab0a2d361:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/azure-functions-hostjson-exposure.yaml

References

Related Vulnerabilities