CVE-2025-10035_GoAnywhere Get RCE# GoAnywhere CVE-2025-10035 Checker
**Description**
A lightweight Python **checker** that detects whether a GoAnywhere instance is vulnerable to **CVE‑2025‑10035**.
This tool sends a crafted GET request with a randomized `User-Agent` (using `fake-useragent` with a fallback list), does **not** follow redirects, inspects the `Location` header, and classifies the instance as **Unpatched (vulnerable)** or **Patched (not vulnerable)**.
> Note: this repository currently contains **only the checker**. A PoC may be added later in a separate, clearly-labeled location if/when appropriate — for now this project is detection-only.
---
## Vulnerability overview
**CVE‑2025‑10035 (summary for this checker)**
An unpatched GoAnywhere AdminErrorHandlerServlet may generate a valid license request token and return it embedded in a redirect URL. That token commonly appears as a `bundle` query parameter in the `Location` header (often redirecting to `my.goanywhere.com`).
- **Unpatched (Vulnerable)** — A crafted request results in an HTTP redirect to `my.goanywhere.com` (or another host) **with a `bundle` query parameter**. Presence of `bundle` = vulnerable.
- **Patched (Not vulnerable)** — The fixed instance either redirects to a local path such as `/license/Unlicensed.xhtml` **without** `bundle`, or does **not** redirect.
> Ethical reminder: **only** run this checker against systems you own or are explicitly authorized to test. Unauthorized scanning may be illegal and/or disruptive.
---
## Features
- Random `User-Agent` per request (`fake-useragent` + fallback list).
- Does **not** follow redirects (`allow_redirects=False`) so the `Location` header can be inspected.
- Multi-threaded scanning via `multiprocessing.dummy.Pool`.
- Colorized terminal output using `colorama`.
- Vulnerable targets appended to a results file.
---
## Requirements
- Python 3.8+ (3.10+ recommended)
- Python packages:
- `requests`
- `fake-useragent`
- `colorama`
- `urllib3` (usually installed with `requests`)
**requirements.txt**
---
## Install dependencies:
python -m venv .venv # optional but recommended
source .venv/bin/activate # macOS / Linux
.venv\Scripts\activate # Windows
pip install -r requirements.txt
---
## Usage Examples
Below are practical examples you can copy/paste to run the checker in different scenarios: single-target rapid test, batch scanning, low-rate scanning for production safety, running inside Docker, and a minimal GitHub Actions snippet to run the checker periodically or on push.
> These examples assume your script file is named `check_goanywhere.py` and is executable with `python check_goanywhere.py`. Adjust filenames, paths, and thread counts to suit your environment.
---
### 1) Basic — scan a list of targets (default threads)
```bash
# Scan targets listed in examples/targets.txt and append vulnerable hosts to results.txt
python check_goanywhere.py examples/targets.txt results.txt
# Use 10 worker threads for faster scanning (be careful with concurrency against production)
python check_goanywhere.py examples/targets.txt results.txt 10
----
## Sample Output
Below are realistic sample outputs you can expect when running the checker. All examples assume the default banner prints at start; lines in `[]` show the colored status messages the script prints to the terminal. After the scan, vulnerable hosts are appended to the results file.
- [-] Not Vulnerable: https://0.0.0.0:443 - n/N
- [-] Erorr: http://0.0.0.0:8000 - n/N
- [-] Erorr: https://0.0.0.0:443 - n/N
- [-] Erorr: https://0.0.0.0:443 - n/N
- [-] Erorr: https://0.0.0.0:443 - n/N
- [-] Not Vulnerable: https://0.0.0.0:443 - n/N
- [+] Vulnerable: https://0.0.0.0:443 - n/N
登录后查看神龙缓存的 POC 文件快照
登录查看