ambassador-api-diagnostics-exposure: Ambassador API Gateway Diagnostics - Exposure

id: ambassador-api-diagnostics-exposure

info:
  name: Ambassador API Gateway Diagnostics - Exposure
  author: 0x_Akoko
  severity: medium
  description: |
    Detected Ambassador API Gateway diagnostics portal, revealing service mappings, API endpoints, routing configurations, and internal cluster information.
  reference:
    - https://www.getambassador.io/docs/edge-stack/latest/
    - https://www.getambassador.io/docs/edge-stack/latest/topics/running/diagnostics/
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"Ambassador Diagnostic Overview"
    fofa-query: title="Ambassador Diagnostic Overview"
  tags: exposure,ambassador,api,gateway,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/ambassador/v0/diag/"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, "Ambassador Diagnostic Overview", "Ambassador version")
          - contains_any(body, "Cluster ID", "Ambassador Route Table", "Ambassador namespace")
        condition: and
# digest: 490a00463044022021fbbc599cebb8eb20c9605bd96b3b5449906d7fea7ab441356ee26f54d87f5e022011a4ae2acebd94842bec8e3b7008479054eb620926ae9b9384138dfd279ba871:922c64590222798bb761d5b6d8e72950