haproxy-status-info-leak: HAProxy status 负载均衡状态

id: haproxy-status-info-leak

info:
  name: HAProxy status 负载均衡状态
  author: 不动明王
  severity: medium
  verified: true
  description: |-
    前端负载均衡，监控后端状态，高可用。
    Dork to find system info leaks using haproxy stats.
    Google Search: inurl:haproxy-status site:example.com
  reference:
    - https://www.cnblogs.com/yinzhengjie/p/12147925.html
    - https://www.exploit-db.com/ghdb/4191
  tags: haproxy,disclosure
  created: 2023/10/29

rules:
  r0:
    request:
      method: GET
      path: /haproxy-status
    expression: response.status == 200 && response.body.bcontains(b'General process information')
  r1:
    request:
      method: GET
      path: /haproxy?stats
    expression: response.status == 200 && response.body.bcontains(b'General process information')
expression: r0() || r1()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.