javamelody-detect: JavaMelody Monitoring Exposed

id: javamelody-detect

info:
  name: JavaMelody Monitoring Exposed
  author: zan8in
  severity: high
  verified: true
  description: |
    JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to "View http sessions".
    This can be used by an attacker to steal a user's session.
    fofa: app="JavaMelody"
  reference:
    - https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
    - https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
    - https://mp.weixin.qq.com/s/ye9qWPm0wcn90zoKQpExGg
    - https://paper.seebug.org/705/

rules:
  r0:
    request:
      method: GET
      path: /monitoring
    expression: response.status == 200 && response.body.bcontains(b'Monitoring JavaMelody on')
  r1:
    request:
      method: GET
      path: /..%3B/monitoring
    expression: response.status == 200 && response.body.bcontains(b'Monitoring JavaMelody on')
expression: r0() || r1()