id: aveva-intouch-access-anywhere-panel

info:
  name: AVEVA InTouch Access Anywhere - Panel
  author: rxerium
  severity: info
  description: |
    Detected AVEVA InTouch Access Anywhere was a secure gateway that provided browser-based remote access to InTouch HMI applications over the internet. It was widely used in industrial process control, utilities, and manufacturing environments. Exposed instances may have provided access to industrial HMI displays and SCADA interfaces.
  reference:
    - https://www.aveva.com/en/products/intouch-hmi/
    - https://www.aveva.com/en/products/intouch-access-anywhere/
  metadata:
    max-request: 1
    verified: true
    vendor: AVEVA
    product: aveva-intouch-access-anywhere
    shodan-query: 'http.html:"InTouch Access Anywhere"'
  tags: panel,ics,scada,aveva,intouch,hmi,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/AccessAnywhere/start.html"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "AppName", "OnClickConnect", "ericom", "InTouch")'
          - 'contains_any(body, "Access Anywhere", "AccessAnywhere")'
        condition: and
# digest: 4b0a00483046022100d163a9ca90633c6411518fd3978fc48710060fc303d7c25762175e5f7d56e592022100ccf067baac80a25498e75e4d773820c15239ef50e24517aeb061215991c6f815:922c64590222798bb761d5b6d8e72950