CVE-2023-32315-POC

CVE-2023-32315-Openfire-Bypass-Py

Overview

This code is a Python version POC for CVE-2023-32315. It performs a series of operations to verify whether the target website is affected by the CVE-2023-32315 vulnerability and attempts to execute certain operations on the affected website.
After verification, the cookie's csrf and jsessionid are not necessary; as long as they exist and are in the correct format, lower versions around 4.0.x do not use csrf. This article does not provide a webshell. You need to download it from https://github.com/tangxiaofeng7/CVE-2023-32315-Openfire-Bypass/releases/tag/v0.1

Features

1. Check the version number of the target website and determine whether it is within the scope affected by the CVE-2023-32315 vulnerability.
2. Obtain the JSESSIONID and CSRF token of the target website.
3. Add a randomly generated user on the target website.

Usage

1. Ensure that the required Python version is installed.
2. Install dependencies: pip install -r requirements.txt.
3. Execute command: python script.py -u to verify a single target website.
4. Execute command: python script.py -l to verify multiple target websites.
5. You can specify the number of threads with the -t parameter, default is 10.
6. Results will be printed on the terminal, and detailed results will be written to the vuln.txt file.

Notes

Please ensure the accessibility and correctness of the target website.
Only use this code under legal authorization.
The author assumes no responsibility for the use of the code and any consequences arising from it.