id: h2o-driverless-ai-panel

info:
  name: H2O Driverless AI Panel - Detect
  author: rxerium
  severity: info
  description: |
    H2O Driverless AI, a commercial automated machine learning (AutoML) platform that provides a web UI typically served on port 12345 for building and deploying machine learning models, was detected. An exposed H2O Driverless AI login panel was identified. It is distinct from H2O Wave and H2O-3/Flow, which are separate H2O.ai products with different branding, ports, and UIs.
  reference:
    - https://h2o.ai/platform/ai-cloud/make/driverless-ai/
    - https://docs.h2o.ai/driverless-ai/latest-stable/docs/userguide/index.html
  metadata:
    verified: true
    max-request: 1
    vendor: h2o.ai
    product: driverless-ai
    shodan-query: 'http.title:"H2O.ai - Login"'
  tags: panel,h2o-driverless-ai,ml,ai,automl,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Server: H2O Driverless AI"

      - type: word
        part: body
        words:
          - "DRIVERLESS AI"
        case-insensitive: true

      - type: status
        status:
          - 200
# digest: 4a0a004730450220568f0f40723e8b6666cabf20c9b7c5f3c260248b68b871507e31291887a0c711022100aaeacbd71400a3de5fe402259454c047bbc4494638ce0b6f8ae3786264f469a1:922c64590222798bb761d5b6d8e72950