CVE-2023-32749 PoC — Abstrium Pydio Cells 安全漏洞

Source

Associated Vulnerability

Description

PoC for CVE-2023-32749 affecting Pydio Cells

Readme

# PoC for CVE-2023-32749

This is a quick and dirty PoC I wrote for CVE-2023-32749 for Pydio Cells. The scripts creates a new user account with the all the roles available when provided with a valid credential.  

All credits goes to the original researchers.


# Installation

The only requirements is the requests package from python to make the web requests. If it is not installed on your system then it can be done with

```bash
pip3 install -r requirements.txt
```


# Usage

```plaintext
exploit.py [-h] -u USER -p PASSWORD -l URL

PoC for PyDio Cells - CVE-2023-32749

options:
  -h, --help            show this help message and exit
  -u USER, --user USER
  -p PASSWORD, --password PASSWORD
  -l URL, --url URL
```


## References

- https://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html
- https://pydio.com/en/docs/developer-guide/rest-api

Again all credits goes to the original PoC at RedTeam Pentesting GmbH

## Disclamer
The usage of this script is at the user's own risk. The author shall not be held responsible for any damages or misuse of this script. It is the user's responsibility to ensure that the script is used in compliance with all applicable laws and regulations.

File Snapshot

 [4.0K]  /data/pocs/9686f4552bf3d4bc3bca5481bcc7c1e4fa21d0e2
├── [2.9K]  exploit.py
├── [1.2K]  README.md
└── [  16]  requirements.txt

0 directories, 3 files

Remarks