http-etcd-unauthenticated-raft: etcd RAFT Unauthenticated API

id: http-etcd-unauthenticated-raft

info:
  name: etcd RAFT Unauthenticated API
  author: x3lfyn
  severity: high
  description: |
    etcd's v2 API is reachable without authentication, exposing the /v2/members endpoint. This endpoint discloses the full cluster membership list, including each member's name, internal peer URLs, and client URLs, without requiring any credentials.
  impact: |
    An unauthenticated attacker can enumerate every node in the etcd cluster along with their internal peer and client addresses.
  remediation: |
    Disable the deprecated v2 API (etcd 3.4+ defaults to v2 disabled; confirm `--enable-v2=false`), enable client authentication and RBAC, and restrict network access to etcd's client
  reference:
    - https://etcd.io/docs/v3.5/op-guide/authentication/
    - https://etcd.io/docs/v3.5/op-guide/security/
  classification:
    cwe-id: CWE-306
  metadata:
    max-request: 1
    vendor: etcd
    product: etcd
    shodan-query: product:"etcd"
  tags: misconfig,unauth,etcd,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/members"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "peerURLs"
          - "clientURLs"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c81fb74a59d90de4b1cd2f5098984c50569e0c05451ea5a089f0e77e6ecb5530022100cffc55b419926adb62502f3f358879d39f5def35aed7e21fde3ba0ffe28c04c0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.