zabbix-api-exposure.yaml

id: zabbix-api-exposure
info:
  name: Zabbix API Exposure
  author: sif
  severity: low
  description: Detects an exposed Zabbix JSON-RPC API that discloses its version pre-authentication
  tags: [zabbix, monitoring, api, json-rpc, exposure, recon]

type: http

http:
  method: POST
  paths:
    - "{{BaseURL}}/api_jsonrpc.php"
    - "{{BaseURL}}/zabbix/api_jsonrpc.php"

  # api_jsonrpc.php answers 412 Precondition Failed unless the request carries
  # one of application/json-rpc, application/json or application/jsonrequest.
  headers:
    Content-Type: application/json-rpc

  body: '{"jsonrpc":"2.0","method":"apiinfo.version","params":{},"id":1}'

  # no response content-type matcher: that type is a request precondition, and
  # zabbix always answers `header('Content-Type: application/json')`. requiring
  # application/json-rpc back never matched a live instance. the jsonrpc-2.0 plus
  # dotted-result shape below is specific to apiinfo.version on its own.
  matchers:
    - type: status
      status:
        - 200

    # two and'd patterns rather than one: json object key order is not
    # guaranteed, so a serializer that emits id before jsonrpc would miss a
    # single pattern that requires them adjacent.
    - type: regex
      part: body
      condition: and
      regex:
        - '"jsonrpc"\s*:\s*"2\.0"'
        - '"result"\s*:\s*"[0-9]+\.[0-9]+(\.[0-9]+)?"'

  extractors:
    - type: regex
      name: zabbix_api_version
      part: body
      regex:
        - '"result"\s*:\s*"([0-9]+\.[0-9]+(?:\.[0-9]+)?)"'
      group: 1