SPIP-CVE-2024-23659-

Python 3 script for validation/exploitation of unauthenticated RCE in SPIP BigUp

---

Description

cve.py automates:

1. SPIP form discovery (formulaire_action and formulaire_action_args).
2. Sending a multipart payload to execute commands on the target server.
3. Reading output via the HTTP header X-Command-Output (base64).
4. Single-command mode or interactive shell.

---

Requirements

• Python 3.8+ (recommended)
• Dependencies:
  • requests
  • beautifulsoup4

Installation:

pip install requests beautifulsoup4

---

Usage

Help

python3 cve.py -h

Main parameters

• -u, --url (required): base URL of the target
  Example: http://web.prod.local
• -c, --command: executes a single command and exits
• --proxy: HTTP/HTTPS proxy (e.g., http://127.0.0.1:8080)
• --timeout: HTTP timeout in seconds (default: 10)
• -v, --verbose: shows request details

---

Examples

1) Verificar y abrir shell interactiva

python3 cve.py -u http://objetivo.local

2) Execute a single command

python3 cve.py -u http://objetivo.local -c "id"

3) Use a proxy (Burp, mitmproxy, etc.)

python3 cve.py -u http://objetivo.local --proxy http://127.0.0.1:8080 -v

4) Adjust timeout

python3 cve.py -u http://objetivo.local --timeout 20

---

Expected flow

• If the target appears vulnerable:
  • Something like this will be displayed: Target vulnerable. Web user: <user>
• If not:
  • An error message indicating that it does not appear vulnerable or that exploitation failed.

---

Quick troubleshooting

• SPIP form fields not found
  • Verify the target URL and connectivity.
  • Try with -v to see HTTP details.
• X-Command-Output does not appear
  • The target may not be vulnerable.
  • There may be a WAF, non-standard paths, or applied mitigations.
• Frequent timeouts
  • Increase --timeout.
  • Check proxy, DNS, and network latency.

---

Legal disclaimer

This repository and its contents are provided exclusively for educational, research, and authorized testing purposes.

The use of this software against systems without explicit authorization is illegal and may constitute a crime.
The author and contributors are not responsible for damages, service interruptions, data loss, legal liabilities, or any misuse arising from this tool.

By using this code, you agree that:

1. You will only run it in your own environments or with express and verifiable permission.
2. You will comply with the laws and regulations applicable in your jurisdiction.
3. You assume all responsibility for its use.

If you are not authorized, do not use it.