来源

关联漏洞

描述

PoC and Setup for CVE-2025-4664

介绍

# CVE-2025-4664
This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests.

# Resources

For a detailed explanation of how this exploit works, read the blog post: https://amalmurali.me/posts/cve-2025-4664e.

Watch this video to understand the flow: 




<a href="https://vimeo.com/1097299035?share=copy" target="_blank"><img src="https://github.com/user-attachments/assets/ba4118f9-9df7-4713-8891-b569a354ac4b"></a>

## Files

- `target.py` - Vulnerable web application
- `idp.py` - SSO identity provider
- `attacker.py` - Malicious server that logs leaked tokens
- `templates/` - HTML templates for the demo
- `static/` - Static assets (logo, avatar, CSS)

## Setup

### Dependencies

```bash
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
```

### Hosts File Configuration

Add these entries to your `/etc/hosts` file:

```
127.0.0.1 example.com
127.0.0.1 sso.example.com  
127.0.0.1 attacker.test
```

### Running the Demo

Start all three servers in separate terminals (after activating the venv):

```bash
# Terminal 1: Target application
python target.py

# Terminal 2: SSO Identity Provider  
python idp.py

# Terminal 3: Attacker server
python attacker.py
```

## Disclaimer

This repository is for educational purposes only. The information provided here is intended to help developers understand the vulnerability and protect their systems. Do not use this exploit maliciously or without permission. Use of this PoC is at your own risk. The author is not responsible for any damages or legal issues that may arise from the use of this information.

文件快照

 [4.0K]  /data/pocs/b8bbd4fc6d526dd024ecbe5c39cc8fec62c38923
├── [1.0K]  attacker.py
├── [2.6K]  idp.py
├── [1.7K]  README.md
├── [  38]  requirements.txt
├── [4.0K]  static
│   ├── [122K]  avatar.png
│   ├── [ 252]  logo.svg
│   └── [  41]  style.css
├── [2.3K]  target.py
└── [4.0K]  templates
    ├── [ 734]  index.html
    ├── [4.5K]  profile.html
    ├── [ 797]  redirecting.html
    └── [1.2K]  sso_login.html

2 directories, 12 files

备注