Apollo Admin Service - Unauthenticated Access

By kannthu

Medium

Vidoc Module

#misconfig#unauth#apollo#apolloadminservice

Description

Author: j4vaovo Classification CWE-ID: CWE-522 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS-Score: 5.8 ApolloAdminservice was able to be accessed without authentication. Reference - https://landgrey.me/blog/20/ Metadata max-request: 1 verified: true shodan-query: http.html:"apollo-adminservice"

Module preview

Concurrent Requests (1)

1. HTTP Request template

GET/apps

Matching conditions

word: appId, orgName, ownerName, dataChangeCre...and

word: application/jsonand

status: 200

Passive global matcher

No matching conditions.

On match action

Report vulnerability