## CVE-2020-7378 – OpenCRX Predictable Password Reset Token and XXE Exploit
This repository contains a combined proof-of-concept (PoC) exploit for **CVE-2020-7378**, a critical vulnerability in **OpenCRX** (versions up to and including 5.0-20200717). The exploit chains two core issues in the application:
1. A **predictable password reset token** vulnerability due to reliance on `java.util.Random`, which allows attackers to generate valid tokens based on a millisecond timestamp seed.
2. A **blind XML External Entity (XXE)** vulnerability in the `RestServlet` endpoint that permits remote file disclosure from the server’s filesystem.
The combination of these two flaws enables an unauthenticated attacker to gain administrative access and exfiltrate sensitive server-side files.
---
### Vulnerability Details
* **CVE ID**: [CVE-2020-7378](https://nvd.nist.gov/vuln/detail/CVE-2020-7378)
* **Affected Product**: OpenCRX ≤ 5.0-20200717
* **Attack Surface**: Publicly exposed management and REST interfaces
* **Root Causes**:
* Insecure pseudo-random token generation during password resets
* Unsafe XML parsing in REST API endpoints
* **Impact**:
* Unauthorized password resets for arbitrary users (including admin)
* Arbitrary file read via XXE injection
* **CVSS**: 9.1 (Critical)
---
### Included Components
* `opencrx-exploit.py`: Full-chain exploit script that performs both token prediction and XXE file read.
* `OpenCRXToken.java`: Java class that emulates the token generation logic using a brute-force seed range based on request timing.
### Usage
1. Compile the token generator:
```bash
javac OpenCRXToken.java
```
2. Run the exploit:
```bash
python3 opencrx-exploit.py <target_user_id>
```
This will:
* Generate and test valid password reset tokens based on the timing window.
* Reset the target user’s password.
* Trigger an XXE payload via the REST API to read a sensitive file from the server.
登录后查看神龙缓存的 POC 文件快照
登录查看