id: fastchat-panel

info:
  name: FastChat Panel - Detect
  author: rxerium
  severity: info
  description: |
    FastChat, an open platform by LMSYS for training, serving, and evaluating large language model based chatbots (used by Vicuna and Chatbot Arena), was detected. An exposed, unauthenticated FastChat Gradio-based web demo instance ("Chat with Open Large Language Models") was identified.
  reference:
    - https://github.com/lm-sys/FastChat
    - https://github.com/lm-sys/FastChat/blob/main/fastchat/serve/gradio_web_server.py
  metadata:
    verified: true
    max-request: 1
    vendor: lm-sys
    product: fastchat
    shodan-query: 'html:"notice_markdown" html:"Chat with Open Large Language Models"'
  tags: panel,fastchat,llm,ai,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Chat with Open Large Language Models"
          - "notice_markdown"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022031c8ace19ac472614d6135791c260da148a5c32182f3c17e007abe3ba4721b4602201d4d19e2b3359eb111c0e4784a220e82adcdaaac669086a2a802f5e657ffe119:922c64590222798bb761d5b6d8e72950