@@ -62,25 +62,25 @@ def initialize(info = {})
6262 end
6363
6464 def check
65- res = send_request_cgi ( {
65+ # Request for Selenium Grid version 3
66+ v3res = send_request_cgi ( {
6667 'method' => 'GET' ,
6768 'uri' => normalize_uri ( target_uri . path )
6869 } )
69- if res &. code != 200
70- res = send_request_cgi ( {
71- 'method' => 'GET' ,
72- 'uri' => normalize_uri ( target_uri . path , 'status' )
73- } )
74- if res && res . get_json_document && res . get_json_document . include? ( 'value' ) &&
75- res . get_json_document [ 'value' ] . include? ( 'message' ) &&
76- res . get_json_document [ 'value' ] [ 'message' ] . downcase . include? ( 'selenium grid' )
77- return Exploit :: CheckCode :: Detected ( 'Selenium Grid version 4.x detected.' )
78- end
70+ # Request for Selenium Grid version 4
71+ v4res = send_request_cgi ( {
72+ 'method' => 'GET' ,
73+ 'uri' => normalize_uri ( target_uri . path , 'status' )
74+ } )
75+ return Exploit :: CheckCode :: Detected ( 'Selenium Grid version 4.x detected.' ) if v3res &. code != 200 &&
76+ v4res && v4res . get_json_document &&
77+ v4res . get_json_document . include? ( 'value' ) &&
78+ v4res . get_json_document [ 'value' ] . include? ( 'message' ) &&
79+ v4res . get_json_document [ 'value' ] [ 'message' ] . downcase . include? ( 'selenium grid' )
7980
80- return Exploit ::CheckCode ::Unknown
81- end
81+ return Exploit ::CheckCode ::Unknown ( 'Unexpected server reply.' ) unless v3res &.code == 200
8282
83- js_code = res . get_html_document . css ( 'script' ) . find { |script | script . text . match ( /var json = Object.freeze\( '(.*?)'\) ;/ ) }
83+ js_code = v3res . get_html_document . css ( 'script' ) . find { |script | script . text . match ( /var json = Object.freeze\( '(.*?)'\) ;/ ) }
8484 return Exploit ::CheckCode ::Unknown ( 'Unable to determine the version.' ) unless js_code
8585
8686 json_str = js_code . text . match ( /var json = Object.freeze\( '(.*?)'\) ;/ ) [ 1 ]
0 commit comments