id: vespa-detect

info:
  name: Vespa - Detect
  author: rxerium
  severity: info
  description: |
    Vespa, an open-source big-data serving engine used for low-latency search, recommendation, and vector/embedding retrieval, increasingly deployed as the retrieval backend in AI and RAG (retrieval-augmented generation) pipelines, was detected. Exposed config-server or container endpoints could have leaked application deployment metadata, cluster status, and version information, and may have allowed unauthenticated access to indexed/vectorized data if the query API was left open.
  reference:
    - https://vespa.ai/
    - https://github.com/vespa-engine/vespa
    - https://docs.vespa.ai/en/reference/state-v1.html
  metadata:
    verified: true
    max-request: 1
    vendor: vespa.ai
    product: vespa
    shodan-query: 'product:"Vespa"'
  tags: tech,vespa,ai,vector-db,search,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/ApplicationStatus"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"vespa"'
          - '"version"'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"vespa"\s*:\s*\{\s*"version"\s*:\s*"([0-9\.]+)"'
# digest: 4a0a0047304502202d993db7423a09f7c5215b635b4b6fb32f7a4bc5ca82b378d60bbb25003d986e022100d56c11ab404111aacae88f1996dfef35107f889eada581e47163ec4f98781d80:922c64590222798bb761d5b6d8e72950