Skip to content

Commit 6cbb30c

Browse files
committed
Avoid the code nesting
1 parent bf64304 commit 6cbb30c

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

modules/exploits/linux/http/selenium_greed_chrome_rce_cve_2022_28108.rb

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -62,25 +62,25 @@ def initialize(info = {})
6262
end
6363

6464
def check
65-
res = send_request_cgi({
65+
# Request for Selenium Grid version 3
66+
v3res = send_request_cgi({
6667
'method' => 'GET',
6768
'uri' => normalize_uri(target_uri.path)
6869
})
69-
if res&.code != 200
70-
res = send_request_cgi({
71-
'method' => 'GET',
72-
'uri' => normalize_uri(target_uri.path, 'status')
73-
})
74-
if res && res.get_json_document && res.get_json_document.include?('value') &&
75-
res.get_json_document['value'].include?('message') &&
76-
res.get_json_document['value']['message'].downcase.include?('selenium grid')
77-
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected.')
78-
end
70+
# Request for Selenium Grid version 4
71+
v4res = send_request_cgi({
72+
'method' => 'GET',
73+
'uri' => normalize_uri(target_uri.path, 'status')
74+
})
75+
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected.') if v3res&.code != 200 &&
76+
v4res && v4res.get_json_document &&
77+
v4res.get_json_document.include?('value') &&
78+
v4res.get_json_document['value'].include?('message') &&
79+
v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
7980

80-
return Exploit::CheckCode::Unknown
81-
end
81+
return Exploit::CheckCode::Unknown('Unexpected server reply.') unless v3res&.code == 200
8282

83-
js_code = res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
83+
js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
8484
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code
8585

8686
json_str = js_code.text.match(/var json = Object.freeze\('(.*?)'\);/)[1]

0 commit comments

Comments
 (0)