Skip to content

Commit bca9a5f

Browse files
committed
Update check
1 parent 11c1b72 commit bca9a5f

File tree

1 file changed

+15
-17
lines changed

1 file changed

+15
-17
lines changed

modules/auxiliary/gather/selenium_file_read.rb

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -58,28 +58,26 @@ def initialize(info = {})
5858
end
5959

6060
def check
61+
# Request for Selenium Grid version 4
62+
v4res = send_request_cgi({
63+
'method' => 'GET',
64+
'uri' => normalize_uri(target_uri.path, 'status')
65+
})
66+
if v4res && v4res.get_json_document && v4res.get_json_document.include?('value') &&
67+
v4res.get_json_document['value'].include?('message')
68+
if v4res.get_json_document['value']['message'] == 'Selenium Grid ready.'
69+
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected and ready.')
70+
elsif v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
71+
return Exploit::CheckCode::Unknown('Selenium Grid version 4.x detected but not ready.')
72+
end
73+
end
74+
6175
# Request for Selenium Grid version 3
6276
v3res = send_request_cgi({
6377
'method' => 'GET',
6478
'uri' => normalize_uri(target_uri.path)
6579
})
66-
if v3res&.code != 200
67-
# Request for Selenium Grid version 4
68-
v4res = send_request_cgi({
69-
'method' => 'GET',
70-
'uri' => normalize_uri(target_uri.path, 'status')
71-
})
72-
if v4res && v4res.get_json_document && v4res.get_json_document.include?('value') &&
73-
v4res.get_json_document['value'].include?('message')
74-
if v4res.get_json_document['value']['message'] == 'Selenium Grid ready.'
75-
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected and ready.')
76-
elsif v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
77-
return Exploit::CheckCode::Unknown('Selenium Grid version 4.x detected but not ready.')
78-
end
79-
end
80-
81-
return Exploit::CheckCode::Unknown('Unexpected server reply.')
82-
end
80+
return Exploit::CheckCode::Unknown('Unexpected server reply.') unless v3res&.code == 200
8381

8482
js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
8583
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code

0 commit comments

Comments
 (0)