id: jenkins-users-exposure

info:
  name: Jenkins Users - Exposure
  author: theamanrawat
  severity: info
  description: |
    Detected an exposed Jenkins asynchPeople endpoint that discloses user information (e.g., users, full names, and profile URLs) allowing user enumeration.
  classification:
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  reference:
    - https://issues.jenkins.io/browse/JENKINS-18884
  metadata:
    max-request: 1
    vendor: jenkins
    product: jenkins
    shodan-query:
      - http.favicon.hash:81586312
      - cpe:"cpe:2.3:a:jenkins:jenkins"
      - product:"jenkins"
    fofa-query: icon_hash=81586312
  tags: exposure,jenkins,vuln,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/asynchPeople/api/json"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "users", "fullName", "absoluteUrl")'
        condition: and
# digest: 4b0a00483046022100be640addbbacb9b9be5349f36132ab47aecf6b75e71bfe7d740d76021f4d5efb022100ca8160242adc21c0eacb81785d9b491f7461222195badc74579a27f7b3d4f019:922c64590222798bb761d5b6d8e72950