CVE-2025-66411 Coder Workspace Agent敏感信息日志泄露漏洞

# CVE-2025-66411 PoC - Sensitive Information Log Disclosure # This PoC demonstrates how to check for exposed sensitive information in Coder logs import requests import json import subprocess import re def check_coder_version(coder_url): """Check Coder server version""" try: response = requests.get(f"{coder_url}/api/v2/version", timeout=10) if response.status_code == 200: return response.json().get('version', '') except: return None def check_vulnerable_versions(version): """Check if version is vulnerable""" if not version: return None # Parse version number match = re.match(r'(\d+)\.(\d+)\.(\d+)', version) if not match: return None major, minor, patch = int(match.group(1)), int(match.group(2)), int(match.group(3)) # Check vulnerable versions if major == 2: if minor == 26 and patch < 5: return True elif minor == 27 and patch < 7: return True elif minor == 28 and patch < 4: return True return False def search_logs_for_secrets(log_locations): """Search log files for sensitive information patterns""" sensitive_patterns = [ r'(?i)(api[_-]?key|token|secret|password|credential)["\']?\s*[:=]\s*["\'][^"\']+["\']', r'-----BEGIN (RSA |EC )?PRIVATE KEY-----', r'aws_access_key_id', r'ghp_[a-zA-Z0-9]{36}', r'gho_[a-zA-Z0-9]{36}', r'sk-[a-zA-Z0-9]{48}' ] findings = [] for log_path in log_locations: try: result = subprocess.run(['grep', '-r', '-E', '|'.join(sensitive_patterns), log_path], capture_output=True, text=True, timeout=30) if result.stdout: findings.append({'log': log_path, 'matches': result.stdout}) except: pass return findings def main(): coder_url = input("Enter Coder server URL: ") version = check_coder_version(coder_url) if not version: print("[-] Could not determine Coder version") return print(f"[+] Coder version: {version}") if check_vulnerable_versions(version): print("[!] This version is VULNERABLE to CVE-2025-66411") print("[+] Checking for sensitive information in logs...") log_locations = [ '/var/log/coder/*.log', '/var/log/containers/*.log', '/var/log/pods/*/workspace-agent/*.log' ] findings = search_logs_for_secrets(log_locations) if findings: print(f"[CRITICAL] Found {len(findings)} potential exposures:") for finding in findings: print(f"\n{finding['log']}:") print(finding['matches']) else: print("[+] No obvious secrets found in checked locations") else: print("[+] Version is NOT vulnerable") if __name__ == "__main__": main()