XXE file inclusion in Akamai CloudTest

This repository is a standalone Python proof-of-concept/operational exploit for CVE-2025-49493, an XXE issue in Akamai CloudTest affecting versions before 60 2025.06.02 (12988). The repository is small and centered on a single executable script, main.py, supported by documentation (README.md), dependency metadata (pyproject.toml, uv.lock), a Python version pin, and a sample targets.txt file. The exploit workflow in main.py is straightforward: it accepts a target list and an attacker-controlled XXE callback server, disables TLS verification warnings, creates a requests session with certificate verification disabled, fingerprints each target for Akamai CloudTest indicators, checks whether the SOAP endpoint /concerto/services/RepositoryService is reachable, and then attempts exploitation by sending a crafted SOAP/XML payload containing an external entity reference to the supplied callback host. The intended success condition is out-of-band interaction from the target to the attacker-controlled DNS/HTTP endpoint, allowing the operator to confirm XXE. Capabilities include batch processing of multiple targets, basic target validation, product fingerprinting via response content/headers, SOAP endpoint reachability checks, XXE payload delivery, colored/timestamped logging, and configurable request timeout. The exploit does not appear to include a post-exploitation payload such as a shell; instead it is focused on vulnerability verification and OOB-triggered XXE/SSRF-style interaction. Because it contains active exploitation logic rather than mere detection, it is best classified as an operational standalone exploit rather than a framework module. Notable implementation details visible from the provided content: the exploit path is hardcoded to /concerto/services/RepositoryService; the script uses requests.Session with verify=False; it looks for CloudTest-related strings such as 'Akamai CloudTest', 'concerto', 'CloudTest', and 'akamai'; and it expects the operator to monitor an external callback infrastructure such as Burp Collaborator, Interactsh, or a custom HTTP server. There is a minor metadata inconsistency in pyproject.toml where the project name references cve-2025-48827 instead of CVE-2025-49493, but the README and script header consistently describe the CloudTest XXE exploit.

This repository is a Python-based operational exploit for CVE-2025-49493, a critical XXE vulnerability in Akamai CloudTest versions before 60 2025.06.02 (12988). The exploit consists of a single main code file (main.py), a README with detailed usage and technical information, and supporting files for Python environment and dependencies. The exploit automates the process of identifying Akamai CloudTest instances, checking for the vulnerable SOAP endpoint (/concerto/services/RepositoryService), and sending a crafted XML payload containing an external entity. The attacker must provide a list of targets (targets.txt) and an XXE server (such as Burp Collaborator or Interactsh) to capture out-of-band requests. The exploit is capable of batch processing multiple targets, provides detailed logging, and robust error handling. The main attack vector is network-based, targeting exposed SOAP endpoints. The payload is a standard XXE vector embedded in a SOAP envelope, and successful exploitation can result in information disclosure, SSRF, DoS, or potentially RCE depending on server configuration. The repository is well-structured, with clear separation of code, documentation, and configuration files.