Cat-32: AI Gateways

NuClide Research · survey initiated 2026-06-01

Platforms: Portkey, Kong AI Gateway, Bifrost (maximhq), one-api, new-api, sub2api, TensorZero, Helicone, Envoy AI Gateway

Threat model: gateway tier aggregates all upstream provider API keys + logs all traffic. Unauth access = master-key compromise across the operator’s entire LLM portfolio.

Reference intel: data/platform-intel/ai-gateways-osint-2026-06-01.md Favicon hashes: shodan/favicon-hashes.md (AI Gateways section) CT catalog: shodan/ct-log-catalog.md (AI Gateways section)

Dork Catalog

Execution Notes

JAXEN run order: fire all 15 via Playwright/Shodan. Log hit count in Hit count column above. Zero = result (log in query-log.md).

FP mitigation:

• Dorks 7+8 (title + port) reduce FP vs title-only (port 3000 narrows to expected deployment port)
• Dorks 2+3 are complementary: dork 2 catches all Kong, dork 3 specifically confirms AI plugin is active
• Dorks 6+4+5 are triple-redundant for Bifrost (favicon OR title OR footer link)

Deduplication: one-api and new-api are forks with distinct favicon hashes; if an IP hits both dork 9 and dork 10, investigate whether both are deployed or it’s a hash collision (unlikely — verified distinct in favicon-hashes.md).

Verification priority after harvest:

1. Kong :8001 (CVE-2020-11710, CVSS 9.8 — highest severity)
2. one-api / new-api (default creds; active exploitation documented)
3. Envoy :9901 (config_dump = plaintext credential exposure)
4. Bifrost (root path bypass)
5. Portkey (SSRF only if version < v1.14.0)

Verification Primitives (post-harvest, passive-first)

# Kong Admin API -- read-only version check
curl -s http://<IP>:8001/ | jq '{version:.version,tagline:.tagline}'
# Confirmed unauth if: tagline = "Welcome to kong"
# STOP here -- do not POST, do not create resources

# one-api / new-api -- title fingerprint only (no login attempt)
curl -s http://<IP>:3000/ | grep -o '<title>[^<]*'
# Confirmed if: "One API" or "New API"
# Default cred check: log as "default cred state unverified" unless explicitly tasked

# Envoy admin -- config dump (read-only, but contains credentials)
curl -s http://<IP>:9901/config_dump | python3 -c "
import sys, json
cfg = json.load(sys.stdin)
# grep for auth patterns -- enumerate metadata, do not exfiltrate
print('config_dump accessible: YES')
print('clusters:', len(cfg.get('configs',[])))
"
# Log: "config_dump accessible, N clusters enumerated" -- do not log credential values

# Bifrost -- root bypass check
curl -s -o /dev/null -w "%{http_code}" http://<IP>:8080/
# Confirmed bypass if: 200 (not 401/403)

# Portkey -- health check
curl -s http://<IP>:8787/ | grep -c "AI Gateway says hey"
# Confirmed if: 1

aimap Fingerprints Needed

New fingerprints to add before Stage 1 scan:

Query Log Reference

All executed dorks logged to: shodan/query-log.md (format: date, dork, hit count)

Dorks Added Post-Reference-Doc Review (2026-06-01)

LiteLLM scope note: LiteLLM is an LLM gateway/proxy (proxy for 100+ LLMs, admin UI, virtual keys). Auth enforced on newer versions but older deployments expose /v1/models, /health, and admin UI unauthenticated. 65,976 is a large population — needs aimap fingerprint + verification pass.