apache-livy-logs: Apache Livy - Logs Exposed

id: apache-livy-logs

info:
  name: Apache Livy - Logs Exposed
  author: icarot
  severity: medium
  description: |
    Detects if the logs/metrics page of the Apache Livy server is exposed.
  reference:
    - https://github.com/apache/livy
  metadata:
    max-request: 3
    vendor: apache
    product: livy
    shodan-query: title:"Livy - Sessions"
  tags: apache,livy,logs,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/metrics/healthcheck"
      - "{{BaseURL}}/metrics/metrics"
      - "{{BaseURL}}/metrics/threads"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'livy.sessions'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022064b172b60ff0bca4cb04499a05d0fc4f1284e94f118ac20f2a0a208a822998fa022058b845a803600ea4683df874c167300516fcaf2a98bad7d9678fae903dfb2b41:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.