POC Details: 5d9feb082ce6375c6c9f9730b2a25ba0999a4d1e

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/apis/victoriametrics-vmagent-api-exposure.yaml

Associated Vulnerability

VictoriaMetrics vmagent - Unauthenticated Targets Exposure Detection template

Description

VictoriaMetrics' vmagent exposes a /targets (human) and /api/v1/targets
(JSON) view of every scrape target it is configured against, with no
authentication by default. This leaks internal service inventory
(hostnames, ports, labels) and scrape health, which is useful recon data
for an attacker mapping an organization's internal infrastructure.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →