DescribeVulnerability

请求参数

返回数据

示例

请求示例

http(s)://[Endpoint]/?Action=DescribeVulnerability
&Id=11369052
&SourceIp=1.2.3.4
&<公共请求参数>

正常返回示例

XML 格式

<DescribeVulnerabilityResponse>
      <Vulnerability>
		    <Impact>对集群服务造成信息泄露或拒绝服务威胁。</Impact>
		    <Status>0</Status>
		    <Args>{"host": "1.2.3.4", "port": 2181, "qps": 1}</Args>
		    <Description>ZooKeeper 是一个开放源码的分布式应用程序协调服务，提供的功能包括:配置维护、名字服务、分布式同步、组服务等。Zookeeper默认是未授权就可以访问，
特别对于公网开放的 Zookeeper 来说，这也导致了信息泄露的存在，具有潜在高风险。</Description>
		    <Poc>
			漏洞地址：1.2.3.4 端口：2181
			返回内容:
			&lt;pre&gt;Environment:
			zookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT
			host.name=iZbp1fqhknu8ntff13g4m8Z
			java.version=1.8.0_181
			java.vendor=Oracle Corporation
			java.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre
			java.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../&lt;/pre&gt;
		</Poc>
		    <LastDiscoveredAt>1546504134000</LastDiscoveredAt>
		    <Owasp>OWASP A5 失效的访问控制</Owasp>
		    <Reference></Reference>
		    <Hostname>1.2.3.4</Hostname>
		    <CommonType>失效的访问控制</CommonType>
		    <Data>{"host": "1.2.3.4", "port": 2181, "proof": "Environment:\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\nhost.name=iZbp1fqhknu8ntff13g4m8Z\njava.version=1.8.0_181\njava.vendor=Oracle Corporation\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../"}</Data>
		    <Severity>3</Severity>
		    <Name>ZooKeeper 未授权访问</Name>
		    <Cwe>CWE-284</Cwe>
		    <Target>1.2.3.4</Target>
		    <Wasc>WASC-2</Wasc>
		    <Id>11507253</Id>
		    <Solution>1、禁止把Zookeeper直接暴露在公网
2、添加访问控制，根据情况选择对应方式（认证用户，用户名密码，指定IP）</Solution>
	  </Vulnerability>
	  <code>200</code>
	  <Success>true</Success>
	  <RequestId>6AAFCBCE-3494-4BF4-AA20-CD4BE491D22B</RequestId>
</DescribeVulnerabilityResponse>

JSON 格式

{
    "Vulnerability": {
        "Impact": "对集群服务造成信息泄露或拒绝服务威胁。",
        "Status": 0,
        "Args": "{\"host\": \"1.2.3.4\", \"port\": 2181, \"qps\": 1}",
        "Description": "ZooKeeper 是一个开放源码的分布式应用程序协调服务，提供的功能包括:配置维护、名字服务、分布式同步、组服务等。Zookeeper默认是未授权就可以访问，\r\n特别对于公网开放的 Zookeeper 来说，这也导致了信息泄露的存在，具有潜在高风险。",
        "Poc": "\r\n漏洞地址：1.2.3.4 端口：2181\r\n返回内容:\r\n<pre>Environment:\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\nhost.name=iZbp1fqhknu8ntff13g4m8Z\njava.version=1.8.0_181\njava.vendor=Oracle Corporation\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../</pre>\r\n",
        "LastDiscoveredAt": 1546504134000,
        "Owasp": "OWASP A5 失效的访问控制",
        "Reference": "",
        "Hostname": "1.2.3.4",
        "CommonType": "失效的访问控制",
        "Data": "{\"host\": \"1.2.3.4\", \"port\": 2181, \"proof\": \"Environment:\\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\\nhost.name=iZbp1fqhknu8ntff13g4m8Z\\njava.version=1.8.0_181\\njava.vendor=Oracle Corporation\\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../\"}",
        "Severity": 3,
        "Name": "ZooKeeper 未授权访问",
        "Cwe": "CWE-284",
        "Target": "1.2.3.4",
        "Wasc": "WASC-2",
        "Id": 11507253,
        "Solution": "1、禁止把Zookeeper直接暴露在公网\r\n2、添加访问控制，根据情况选择对应方式（认证用户，用户名密码，指定IP）"
    },
    "code": 200,
    "Success": true,
    "RequestId": "6AAFCBCE-3494-4BF4-AA20-CD4BE491D22B"
}

错误码

访问错误中心查看更多错误码。