Skip to content

Commit 4d42c78

Browse files
committed
improve the regex by removing the unnecessary word boundrys, and add a non matching group for the product name. Thanks jvoisin
1 parent e340e3e commit 4d42c78

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,9 @@ def check
9696

9797
# We expect the server to respond with an HTTP Server header like "Cleo LexiCom/5.8.0.0 (Windows Server 2022)".
9898
# Note, the target product may be either LexiCom, VLTrader, or Harmony.
99-
if res.headers.key?('Server') && (res.headers['Server'] =~ %r{cleo\s+(\blexicom\b|\bvltrader\b|\bharmony\b)/(\d+\.\d+\.\d+\.\d+)}i)
99+
if res.headers.key?('Server') && (res.headers['Server'] =~ %r{cleo\s+(?:lexicom|vltrader|harmony)/(\d+\.\d+\.\d+\.\d+)}i)
100100

101-
if Rex::Version.new(Regexp.last_match(2)) <= Rex::Version.new('5.8.0.23')
101+
if Rex::Version.new(Regexp.last_match(1)) <= Rex::Version.new('5.8.0.23')
102102
return CheckCode::Appears(res.headers['Server'])
103103
end
104104

0 commit comments

Comments
 (0)