id: jolokia-heap-info-disclosure

info:
  name: Jolokia Java Heap Information Disclosure
  author: milo2012
  severity: info
  metadata:
    max-request: 1
  tags: jolokia,disclosure,java

http:
  - raw:
      - |
        POST /jolokia/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        {
           "type":"EXEC",
           "mbean":"com.sun.management:type=HotSpotDiagnostic",
           "operation":"dumpHeap",
           "arguments":[
              "/tmp1234/test1.hprof",
              0
           ]
        }

    matchers:
      - type: word
        part: body
        words:
          - 'stacktrace":"java.io.IOException: No such file or directory'
# digest: 490a0046304402202ff37c3559fdbcbda1665a169f93b2ef14a6cc601131d54d7f808687e072b12002205e4cec41f8dd6925284a2932023b6f1370a084e699fc7bce5303b9cef21d6884:922c64590222798bb761d5b6d8e72950