zipkin-config-exposure: Zipkin Configuration - Exposure

id: zipkin-config-exposure

info:
  name: Zipkin Configuration - Exposure
  author: theamanrawat
  severity: low
  description: |
    Detected the exposure of the Zipkin configuration endpoint (/config.json), which may reveal internal configuration details.
  reference:
    - https://zipkin.io/
  tags: zipkin,exposure,config

http:
  - method: GET
    path:
      - "{{BaseURL}}/config.json"
      - "{{BaseURL}}/zipkin/config.json"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"queryLimit":'
          - '"environment":'
          - '"instrumented":'
          - '"defaultLookback":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502204d6191b89e8a20f747d19afd968eccb13ac895c199d8005b70b6e1e241d4f45b0221009395f2d6394ab73dd980b4271e3bea7f8897fb3373fd62fe031135a5fea1e22b:922c64590222798bb761d5b6d8e72950