gRPC Reflection API Abuse: Service Enumeration and Data Exposure

┌─────────────────────────────────────────────────────────────────┐
│            gRPC REFLECTION ABUSE ATTACK FLOW                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. Attacker discovers open gRPC port (50051, 9090, etc.)       │
│                         ↓                                        │
│  2. Attacker sends ListServices reflection RPC                   │
│                         ↓                                        │
│  3. Server returns all registered service names                  │
│     e.g., myapp.AdminService, myapp.PaymentService              │
│                         ↓                                        │
│  4. Attacker queries FileContainingSymbol for each service       │
│                         ↓                                        │
│  5. Server returns full .proto definitions:                      │
│     methods, message types, field names, enums                   │
│                         ↓                                        │
│  6. Attacker now has complete API blueprint                      │
│     Can craft targeted calls to any method                       │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

// Connect and query reflection
client := grpc_reflection_v1alpha.NewServerReflectionClient(conn)
stream, err := client.ServerReflectionInfo(ctx)

// Request all services
stream.Send(&grpc_reflection_v1alpha.ServerReflectionRequest{
    MessageRequest: &grpc_reflection_v1alpha.ServerReflectionRequest_ListServices{
        ListServices: "*",
    },
})

// Parse response
resp, _ := stream.Recv()
for _, service := range resp.GetListServicesResponse().Service {
    if isSensitiveServiceName(service.Name) {
        result.HasSensitiveNames = true
        result.SensitiveServices = append(result.SensitiveServices, service.Name)
    }
}

func isSensitiveServiceName(serviceName string) bool {
    sensitiveKeywords := []string{
        "admin", "internal", "private", "debug", "test",
        "management", "auth", "user", "account", "payment",
        "billing", "credential", "secret", "token", "key",
    }
    lowerName := strings.ToLower(serviceName)
    for _, keyword := range sensitiveKeywords {
        if strings.Contains(lowerName, keyword) {
            return true
        }
    }
    return false
}

# Basic scan
cxg scan --scope target.com:50051 --templates grpc-reflection-abuse.go

# Multiple ports
cxg scan --scope target.com:9090 --templates grpc-reflection-abuse.go
cxg scan --scope target.com:50051 --templates grpc-reflection-abuse.go

# With extended timeout for slow networks
cxg scan --scope target.com:50051 --templates grpc-reflection-abuse.go --timeout 30s

# JSON output for pipeline integration
cxg scan --scope target.com:50051 --templates grpc-reflection-abuse.go --json

# Quick check — if this returns service names, reflection is exposed
grpcurl -plaintext target.com:50051 list

# Describe a specific service
grpcurl -plaintext target.com:50051 describe myapp.AdminService

# Should return error if properly secured
grpcurl -plaintext target.com:50051 list 2>&1 | grep -i "unimplemented\|unknown service"

{
  "findings": [
    {
      "target": "target.com:50051",
      "template_id": "grpc-reflection-abuse",
      "severity": "high",
      "confidence": 95,
      "title": "gRPC Reflection Exposes Sensitive Services",
      "description": "Reflection API enabled and exposes 8 service(s), including 3 with sensitive names.",
      "evidence": {
        "reflection_enabled": true,
        "service_count": 8,
        "services": [
          "myapp.UserService",
          "myapp.AdminService",
          "myapp.PaymentService",
          "myapp.OrderService",
          "myapp.InternalMetrics",
          "myapp.HealthCheck",
          "myapp.ProductCatalog",
          "myapp.NotificationService"
        ],
        "has_sensitive_names": true,
        "sensitive_services": [
          "myapp.AdminService",
          "myapp.PaymentService",
          "myapp.InternalMetrics"
        ]
      }
    }
  ]
}

{
  "findings": [
    {
      "target": "target.com:50051",
      "template_id": "grpc-reflection-abuse",
      "severity": "info",
      "confidence": 50,
      "title": "gRPC Reflection Not Available",
      "description": "gRPC reflection service not accessible: connection failed or reflection unimplemented"
    }
  ]
}

// Remove or conditionally register reflection
// BEFORE (vulnerable):
reflection.Register(grpcServer)

// AFTER (environment-gated):
if os.Getenv("ENABLE_GRPC_REFLECTION") == "true" {
    reflection.Register(grpcServer)
}

// Use build tags
//go:build dev
reflection.Register(grpcServer)

# Only in development
if settings.DEBUG:
    from grpc_reflection.v1alpha import reflection
    reflection.enable_server_reflection(SERVICE_NAMES, server)

// Conditional registration
if (System.getenv("ENABLE_REFLECTION") != null) {
    ProtoReflectionService.newInstance();
}

# After remediation — should fail with "unimplemented" or connection refused
grpcurl -plaintext your-server.com:50051 list 2>&1 | grep -i "unimplemented\|unknown service\|refused"

func scanMultiplePorts(host string) []Finding {
    ports := []int{9090, 50051, 8080, 443}
    allFindings := []Finding{}
    for _, port := range ports {
        findings := testVulnerability(host, port, 10)
        allFindings = append(allFindings, findings...)
    }
    return allFindings
}

func loadSensitiveKeywords() []string {
    keywords := []string{
        "admin", "internal", "private",
        // Add organization-specific terms
        "mycompany", "confidential", "restricted",
    }
    if data, err := os.ReadFile("keywords.txt"); err == nil {
        lines := strings.Split(string(data), "\n")
        keywords = append(keywords, lines...)
    }
    return keywords
}