id: prometheus-unauth

info:
  name: Prometheus Monitoring System - Unauthenticated
  author: pussycat0x
  severity: high
  description: |
    Detects unauthenticated access to Prometheus Time Series Collection and Processing Server by checking for specific elements in the response from the `/graph` endpoint.
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"Prometheus Time Series"
  tags: unauth,prometheus,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/config"
      - "{{BaseURL}}/api/v1/status/config"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "global:"
          - "scrape_configs:"
          - "scrape_interval"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022038fbf4ac954590d93736aee1a9fcca68f1c125234218912a7cf417141f96945e022079ddcf33a3d4118b8329efe3edfc6b8d0ca62b18b1b8523af40876a229302a5f:922c64590222798bb761d5b6d8e72950