@@ -58,28 +58,26 @@ def initialize(info = {})
5858 end
5959
6060 def check
61+ # Request for Selenium Grid version 4
62+ v4res = send_request_cgi ( {
63+ 'method' => 'GET' ,
64+ 'uri' => normalize_uri ( target_uri . path , 'status' )
65+ } )
66+ if v4res && v4res . get_json_document && v4res . get_json_document . include? ( 'value' ) &&
67+ v4res . get_json_document [ 'value' ] . include? ( 'message' )
68+ if v4res . get_json_document [ 'value' ] [ 'message' ] == 'Selenium Grid ready.'
69+ return Exploit ::CheckCode ::Detected ( 'Selenium Grid version 4.x detected and ready.' )
70+ elsif v4res . get_json_document [ 'value' ] [ 'message' ] . downcase . include? ( 'selenium grid' )
71+ return Exploit ::CheckCode ::Unknown ( 'Selenium Grid version 4.x detected but not ready.' )
72+ end
73+ end
74+
6175 # Request for Selenium Grid version 3
6276 v3res = send_request_cgi ( {
6377 'method' => 'GET' ,
6478 'uri' => normalize_uri ( target_uri . path )
6579 } )
66- if v3res &.code != 200
67- # Request for Selenium Grid version 4
68- v4res = send_request_cgi ( {
69- 'method' => 'GET' ,
70- 'uri' => normalize_uri ( target_uri . path , 'status' )
71- } )
72- if v4res && v4res . get_json_document && v4res . get_json_document . include? ( 'value' ) &&
73- v4res . get_json_document [ 'value' ] . include? ( 'message' )
74- if v4res . get_json_document [ 'value' ] [ 'message' ] == 'Selenium Grid ready.'
75- return Exploit ::CheckCode ::Detected ( 'Selenium Grid version 4.x detected and ready.' )
76- elsif v4res . get_json_document [ 'value' ] [ 'message' ] . downcase . include? ( 'selenium grid' )
77- return Exploit ::CheckCode ::Unknown ( 'Selenium Grid version 4.x detected but not ready.' )
78- end
79- end
80-
81- return Exploit ::CheckCode ::Unknown ( 'Unexpected server reply.' )
82- end
80+ return Exploit ::CheckCode ::Unknown ( 'Unexpected server reply.' ) unless v3res &.code == 200
8381
8482 js_code = v3res . get_html_document . css ( 'script' ) . find { |script | script . text . match ( /var json = Object.freeze\( '(.*?)'\) ;/ ) }
8583 return Exploit ::CheckCode ::Unknown ( 'Unable to determine the version.' ) unless js_code
0 commit comments