selenium-grid-exposure: Selenium Grid Exposure

2026-01-16 Selenium Grid PoC Public

Description

Detected Selenium Grid console without authentication, exposing internal network IPs, container names, OS details, software versions, and browser node configurations. Attackers could abuse this for SSRF, internal reconnaissance, or resource hijacking.

PoC

id: selenium-grid-exposure

info:
  name: Selenium Grid Exposure
  author: 0x_Akoko
  severity: high
  description: |
    Detected Selenium Grid console without authentication, exposing internal network IPs, container names, OS details, software versions, and browser node configurations. Attackers could abuse this for SSRF, internal reconnaissance, or resource hijacking.
  reference:
    - https://www.selenium.dev/documentation/grid/
    - https://github.com/SeleniumHQ/selenium
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Selenium Grid" "ready"
    fofa-query: body="Selenium Grid" && body="ready"
  tags: selenium,grid,testing,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wd/hub/status"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"value\"", "\"ready\"", "\"message\"", "Selenium Grid ready")'
          - 'contains_any(body, "\"browserName\"", "\"slots\"", "\"availability\"")'
        condition: and
# digest: 4b0a00483046022100899184585bf266fc3d21c9be352edefe3e6715e16017ea368e1d81484191f8ce022100b8b90b5ec2c569d402c5d43ddb24c0eaf22d56b8394d9b9330caeb5136d1f646:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/selenium-grid-exposure.yaml

References

Related Vulnerabilities