CVE-2025-51867 PoC — Deepfiction AI 安全漏洞

介绍

# CVE-2025-51867
## Vulnerability description

   Deepfiction AI is an AI entertainment company with a mission to revolutionize personalized storytelling. Deepfiction AI provide a web application to create stories by chatting with LLM, which is vulnerable to Insecure Direct Object Reference (IDOR) in its chat component. An attacker can exploit this IDOR to chat with LLM with other users' credits.

## Attack Vectors

   The API endpoint `https://www.deepfiction.ai/api/story/create-story-part` is utilized to initiate or continue conversations. Testing indicates that this API solely relies on the `treatment_id` and `user_id` fields within the request body for access control.

   It has been observed that `id` and `author_id` fields are exposed in publicly accessible conversations listed on the webpage `https://www.deepfiction.ai/browse/stories`. These exposed fields directly correspond to the `treatment_id` (mapping to `id`) and `user_id` (mapping to `author_id`) parameters expected by the `create-story-part` API.

   As a result, an attacker can substitute the leaked `id` (as `treatment_id`) and `author_id` (as `user_id`) into requests to this API. This enables them to interact with the Large Language Model (LLM) by consuming the credits of other users. The figures shows the POC of this vulnerability.

   ![Figure 1 IDOR](./figure1.png)

   ![Figure 2 id leakage](./figure2.png)

   Additionally, analysis of network traffic (e.g., through packet capture) can reveal the specific role configurations (character settings) for each Character. These configurations are analogous to system prompts and represent important system resources of the LLM ChatBot. This exposure also constitutes a form of sensitive data leakage, as it may reveal proprietary prompt engineering details or character definitions.

   ![Figure 3 role configuration leakage](./figure3.png)

## Vulnerability affected

   This vulnerability can have an impact on any user of https://www.deepfiction.ai. The chat credit of user will be abused with leaked treatment_id and user_id.

文件快照

备注