POC详情: 4effed4b1f566cf3540a6e401394061cf03a1667

来源
关联漏洞
标题: Ivanti多款产品 安全漏洞 (CVE-2025-0282)
描述:Ivanti Connect Secure(ICS)等都是美国Ivanti公司的产品。Ivanti Connect Secure是一款安全远程网络连接工具。Ivanti Policy Secure(IPS)是一个网络访问控制 (NAC) 解决方案。Ivanti Neurons是一款开创性的平台,能简化和自动化IT系统。 Ivanti多款产品存在安全漏洞,该漏洞源于存在基于堆栈的缓冲区溢出问题。攻击者利用该漏洞可以远程执行代码。以下产品及版本受到影响:Ivanti Connect Secure 22.7R2
描述
Safely detect if an Ivanti server is vulnerable to CVE-2025-0282
介绍
# CVE-2025-0282-check

Safely detect if an Ivanti server is vulnerable to CVE-2025-0282. Refer to our [blog post](https://bishopfox.com/blog/analysis-and-scanner-for-ivanti-cve-2025-0282) for more details.

## Usage

```
./scan-cve-2025-0282.py <SCHEME://HOST[:PORT]>
```

If you don't specify the port, it will default to 443.

```
$ ./scan-cve-2025-0282.py https://192.168.50.208
https://192.168.50.208:443: Vulnerable

$ ./scan-cve-2025-0282.py https://192.168.50.135
https://192.168.50.135:443: Patched

$ ./scan-cve-2025-0282.py https://192.168.50.47
https://192.168.50.47:443: Version 9.1.12.6427 is not affected
```

Use `parallel` to scan multiple targets in one go. Put each target on a separate line and save it to `targets.txt`, then run the following (`-j` controls how many threads are run in parallel):

```
$ cat targets.txt | parallel -j 10 './scan-cve-2025-0282.py {}'
https://192.168.50.208:443: Vulnerable
https://192.168.50.135:443: Patched
https://192.168.50.47:443: Version 9.1.12.6427 is not affected
```

## How it works

Patched systems restrict the size of multiple fields in the clientInfo string, even though CVE-2025-0282 can only be triggered through clientCapabilties. As a result, we can just look for an error response when validation fails on a patched system. Patched systems return an ERROR, and unpatched systems will timeout waiting for the client to perform EAP authentication.
文件快照

[4.0K] /data/pocs/4effed4b1f566cf3540a6e401394061cf03a1667 ├── [ 34K] LICENSE ├── [1.4K] README.md └── [3.6K] scan-cve-2025-0282.py 0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。