id: seldon-core-detect

info:
  name: Seldon Core - Detect
  author: rxerium
  severity: info
  description: |
    Seldon Core, an open-source MLOps/LLMOps framework for deploying, monitoring, and scaling machine learning models on Kubernetes, was detected. Its Pipeline Gateway component, which routes inference requests between chained model pipelines, exposed an unauthenticated status endpoint returning a fixed JSON banner and a matching Server response header. Exposed instances may have revealed internal ML pipeline configuration and provided a foothold for further probing of the inference API.
  reference:
    - https://github.com/SeldonIO/seldon-core
    - https://docs.seldon.ai/seldon-core-2
  metadata:
    verified: true
    max-request: 1
    vendor: seldonio
    product: seldon-core
    shodan-query: '"seldon-pipelinegateway"'
  tags: tech,seldon-core,ml,ai,mlops,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '"name":\s*"seldon-pipelinegateway"'

      - type: word
        part: header
        words:
          - "seldon-pipelinegateway"
# digest: 4a0a004730450220148cb952f2f38675e49aa56ed21ecb2c30222562d8ba13919cbfe059f86a3223022100f831c8a769cd501d7b05031cef4d0da4d09312379df63125fd6267e23b6d3631:922c64590222798bb761d5b6d8e72950