CVE-2025-31324：SAP NetWeaver 漏洞主动扫描器（Burp Suite 插件）

# 核心功能：构造并发送测试文件上传请求
def doActiveScan(self, baseRequestResponse, insertionPoint):
    # 1. 目标检测：仅针对特定的漏洞端点
    request_info = self._helpers.analyzeRequest(baseRequestResponse)
    url = str(request_info.getUrl())
    if not url.lower().endswith("/developmentserver/metadatauploader"):
        return None

    # 2. 漏洞验证：构造一个无害的文本文件上传请求
    test_filename = "test_cve_2025_31324.txt"
    test_content = "CVE-2025-31324 test file"
    boundary = "----WebKitFormBoundaryTest1234"
    # 构建 multipart/form-data 的请求体
    body = (
        "--{}\r\n"
        'Content-Disposition: form-data; name="file"; filename="{}"\r\n'
        "Content-Type: text/plain\r\n"
        "\r\n"
        "{}\r\n"
        "--{}--\r\n"
    ).format(boundary, test_filename, test_content, boundary)

    # 3. 构造完整的 HTTP 请求
    headers = [
        "POST {} HTTP/1.1".format(request_info.getUrl().getPath()),
        "Host: {}".format(request_info.getUrl().getHost()),
        "Content-Type: multipart/form-data; boundary={}".format(boundary),
        "Content-Length: {}".format(len(body)),
        "Connection: close"
    ]
    request = "\r\n".join(headers) + "\r\n\r\n" + body

    # 4. 发送请求并接收响应
    check_request = self._helpers.stringToBytes(request)
    response = self._callbacks.makeHttpRequest(
        baseRequestResponse.getHttpService(), check_request
    )

    # 5. 结果判定：通过状态码判断是否存在漏洞
    response_info = self._helpers.analyzeResponse(response.getResponse())
    status_code = response_info.getStatusCode()
    # 如果返回200，则认为可能存在漏洞
    if status_code == 200:
        # 创建并返回一个自定义的漏洞报告


    return None

# 核心功能：自定义漏洞报告，包含详细的上下文信息

    def __init__(self, httpService, url, httpMessages, name, detail, severity, confidence, evidence):
        self._httpService = httpService
        self._url = url
        self._httpMessages = httpMessages
        self._name = name
        # 将证据格式化后附加到详情中
        self._detail = detail + "<br><br><b>Evidence:</b><ul><li>" + "</li><li>".join(evidence) + "</li></ul>"
        self._severity = severity
        self._confidence = confidence


        # 提供漏洞的权威背景信息
        return "CVE-2025-31324 is a critical vulnerability in SAP NetWeaver Visual Composer, allowing unauthenticated attackers to upload malicious files, potentially leading to remote code execution. CVSS Score: 10.0."

    def getRemediationBackground(self):
        # 提供清晰的修复指引
        return "Apply SAP Security Note 3594142 immediately to patch the vulnerability. Restrict access to the /developmentserver/metadatauploader endpoint."