id: mageai-panel

info:
  name: Mage AI Panel - Detect
  author: ChrisJr404
  severity: info
  description: |
    Mage AI (mage.ai / github.com/mage-ai/mage-ai) is an open-source data pipeline + orchestration platform with a notebook-style UI. Self-hosted instances default to TCP 6789 and historically have shipped without authentication. Exposed instances may reveal pipeline source, secrets, and provide an authenticated path to arbitrary code execution via custom blocks.
  reference:
    - https://github.com/mage-ai/mage-ai
    - https://docs.mage.ai/
  metadata:
    verified: true
    max-request: 2
    vendor: mage_ai
    product: mage-ai
    shodan-query: http.title:"Mage"
    fofa-query: title="Mage"
  tags: panel,mageai,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/api/status"

    host-redirects: true
    max-redirects: 2
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 && contains(to_lower(body), "<title>mage</title>")'
          - 'status_code == 200 && contains_all(body, "status\":\"OK", "\"is_instance_healthy\":true")'
          - 'status_code == 200 && contains_all(body, "statuses\":", "is_instance_manager\":", "scheduler_status\":")'
        condition: or
# digest: 4b0a00483046022100ad96e8abedfd5d56bd42aabe7f1a4828bd493c2412830b9844778b1e6bd0d9ac022100a3a5f6325851f7d644bc9c4c2bed3dde2f3ddb2b935adfbaf515aee84d6f00f5:922c64590222798bb761d5b6d8e72950