prefect-api-exposure: Prefect Server Unauthenticated API Exposure

id: prefect-api-exposure

info:
  name: Prefect Server Unauthenticated API Exposure
  author: HaroonArshad-53
  severity: medium
  description: |
    Prefect Server was a self-hosted workflow orchestration server that exposed its API and web UI without authentication by default. Unauthenticated users could access the OpenAPI specification, which identified the Prefect REST API and its endpoints, potentially exposing flow, deployment, and flow-run data.
  impact: |
    An unauthenticated attacker could access the exposed Prefect API, enumerate workflows, deployments, and flow-run history, and interact with orchestration endpoints without credentials.
  remediation: |
    Prefect Server should not have been exposed publicly and should have been protected with authentication, a reverse proxy, or a VPN.
  reference:
    - https://github.com/PrefectHQ/prefect
    - https://www.prefect.io/
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
    vendor: prefecthq
    product: prefect
  tags: prefect,exposure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/openapi.json"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Prefect REST API"
          - '"openapi"'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022040f90a9a583b94398dc85e799fc595f3b222aef3fe5806c4d3bb50ba0578859f022050f451ca56d100bc31cf60e16e11557fb57d944ba6813eac059cece191c7f991:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.