hikvision-env: Hikvision Springboot Env Actuator - Detect

id: hikvision-env

info:
  name: Hikvision Springboot Env Actuator - Detect
  author: SleepingBag945
  severity: high
  description: |
    The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HiKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20env%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
    - https://peiqi.wgpsec.org/wiki/iot/HIKVISION/HiKVISION%20综合安防管理平台%20env%20信息泄漏漏洞.html
  metadata:
    verified: true
    max-request: 5
    shodan-query: app="HIKVISION-综合安防管理平台"
  tags: misconfig,hikvision,springboot,env,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/artemis/env"
      - "{{BaseURL}}/artemis-portal/artemis/env"
      - "{{BaseURL}}/artemis/actuator/env"
      - "{{BaseURL}}/artemis;/env;"
      - "{{BaseURL}}/artemis/1/..;/env"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "applicationConfig"
          - "activeProfiles"
        condition: or

      - type: word
        part: body
        words:
          - "server.port"
          - "local.server.port"
        condition: or

      - type: word
        part: header
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fd4a4dabd348b7ab26cf8eda6c163f15d4cf9de8f65e2d7d0b70fba26584513b02207c8d6d47d12ff33c81f6bb57b6cc88cf79b21447045609071df505e1d7b737f7:922c64590222798bb761d5b6d8e72950