consul-rexec-rce: Consul rexec RCE

id: consul-rexec-rce

info:
  name: Consul rexec RCE
  author: imlonghao
  severity: high
  verified: false
  description: |-
    Consul rexec RCE
  tags: consul,rexec,rce
  created: 2024/04/04

rules:
  r0:
    request:
      method: GET
      path: /v1/agent/self
    expression: 'response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"DisableRemoteExec\": false")'
expression: r0()