POC详情： 919e1ea8ebdc816eff6ebff575701fc4496d9637

来源
https://github.com/saykino/CVE-2023-34732
关联漏洞
标题： Flytxt NEON-dX 安全漏洞 (CVE-2023-34732)
描述：Flytxt NEON-dX是Flytxt公司的一款企业级软件产品，用于实现智能数字客户互动自动化。 Flytxt NEON-dX存在安全漏洞，该漏洞源于change password函数中userId参数未验证，可能导致暴力破解攻击。
介绍
# CVE-2023-34732 Authenticated Function Abuse for Account Takeover 

# Description

An attacker can brute-force any user's password (including admins) using the userId parameter in the change password functionality and update the user's password to a new one chosen by the attacker.

 ------------------------------------------
  
# CVSS Score: 8.8 (High)

------------------------------------------
 Attack Type

 * Remote (Authenticated)
   
------------------------------------------

 Affected Versions

* versions before <= v0.0.1

------------------------------------------
 Vendor of Product

*  Flytxt - NEON-dX

 ------------------------------------------

  Affected Product Code Base
  
* NEON-dX - v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c

 ------------------------------------------

  Affected Component
  
* change password function.

 ------------------------------------------ 
 
 Mitigations

* Update password functionality should be based on the session cookie rather userId parameter.
* Use request rate limit.
  
------------------------------------------
Vulnerability Details

* The change password functionality relies on the userId parameter rather than the currently authenticated session or token. This allows an attacker to enumerate or brute-force other users' identifiers and reset their passwords, resulting in account takeover

------------------------------------------

 Fixed versions
 * v0.0.1 > versions after
 
------------------------------------------

 Discoverer
 * Yazan Abu-Nadi
文件快照

 [4.0K]  /data/pocs/919e1ea8ebdc816eff6ebff575701fc4496d9637
└── [1.5K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。