CVE-2025-55449 PoC — AstrBot 安全漏洞

Source

https://github.com/Marven11/CVE-2025-55449-AstrBot-RCE

Associated Vulnerability

Title:AstrBot 安全漏洞 (CVE-2025-55449)
Description:AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

Description

AstrBot老版本RCE

Readme

# 介绍

AstrBot<=3.5.17在[源码中](https://github.com/AstrBotDevs/AstrBot/blob/v3.5.17/astrbot/core/__init__.py)硬编码了JWT secret，导致可以任意上传插件，实现RCE

# 使用

```shell
python main.py 'http://127.0.0.1:6185'
```

# 源码

https://github.com/AstrBotDevs/AstrBot.git

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!